Romanian intelligence services say a Russian-directed network was responsible for a fire near an arms manufacturing facility in Brașov. Investigations involving Germany and Poland have exposed what authorities describe as a wider operation targeting military and industrial defence infrastructure across Europe.

Romania has accused Russia of coordinating a cross-border sabotage network responsible for an industrial fire near an arms manufacturing facility, prompting a diplomatic confrontation with Moscow and investigations involving several European countries.

Romanian intelligence and prosecutors announced on 26th October that they had identified three foreign nationals allegedly involved in the operation, which caused a fire on an industrial site in Brașov on 14th September.

The suspects, two Belarusian nationals and one Ukrainian, are alleged to have participated in a network directed by individuals operating from Russia.

Two suspects have been detained in Germany, while a third has been located in Poland.

Romania is seeking their extradition as investigators examine possible connections to other attempted attacks against military and industrial installations.

Russia has rejected the allegations.

The case has drawn attention to the security of European defence production facilities at a time when NATO governments are seeking to increase military manufacturing capacity and sustain assistance to Ukraine.

Fire near a Romanian arms manufacturer

The investigation concerns an industrial complex in Brașov, a city with an established defence manufacturing sector.

The fire occurred on 14th September at premises situated close to CARFIL SA, a subsidiary of Romania’s state-owned defence company ROMARM.

According to the Romanian Intelligence Service, the incident was caused by individuals belonging to a sabotage network coordinated from the Russian Federation.

The fire damaged premises occupied by several commercial businesses.

Although the industrial site is associated with the CARFIL complex, authorities have not established publicly that the arms manufacturing facility itself sustained damage.

That geographical distinction is important when assessing the consequences of the operation.

CARFIL manufactures military equipment and ammunition and has pursued partnerships involving drones, explosives and other defence technologies.

Its proximity to the incident has heightened concerns about the security of industrial facilities supporting Romania’s armed forces.

Suspects identified in three countries

Romania’s Directorate for Investigating Organised Crime and Terrorism, known as DIICOT, says the evidence connects three individuals to the incident.

According to Romanian national news agency AGERPRES, the Bucharest Court of Appeal issued European arrest warrants following the investigation.

Two suspects were detained in Germany while allegedly preparing similar operations.

The third was located in Poland, where authorities received a further European arrest warrant issued on 26 October.

Romanian prosecutors are pursuing extradition procedures.

The nationalities of the suspects do not establish responsibility on the part of Belarus or Ukraine. Romanian authorities attribute the alleged coordination to individuals based in Russia.

The investigation also indicates that the Brașov incident may not have been an isolated operation.

Romanian intelligence claims the network’s potential targets included government-owned and private arms manufacturers, military-related facilities and other strategic industrial sites in several European countries.

Those claims remain subject to ongoing criminal investigation.

Bucharest summons Russian ambassador

The Romanian government escalated the matter diplomatically on 27th October.

Foreign Minister Dan Neculăescu summoned Russia’s ambassador, Vladimir Lipaev, to deliver a formal protest concerning the alleged operation.

According to the Romanian Foreign Ministry’s account reported by AGERPRES, Bucharest stated that evidence gathered during the investigation demonstrated Russian responsibility.

The ministry described the operation as part of a broader pattern of hostile activity affecting European states.

President Nicușor Dan also condemned the alleged sabotage, linking it to attempts to undermine European security and solidarity.

Moscow rejected the accusations.

The Russian Embassy maintained that the allegations were unfounded and disputed Romania’s account of the evidence presented during the diplomatic meeting.

The conflicting positions mean the attribution remains contested, notwithstanding the conclusions announced by Romania’s intelligence authorities.

A recruitment model designed for deniability

The Romanian Intelligence Service has provided details about how it believes the wider network recruits and directs participants.

According to its statement, recruitment can begin through social media with offers of payment for apparently minor activities, such as photographing or observing particular locations.

Subsequent assignments may become more serious, involving property destruction, arson or other acts of violence.

Individuals may be targeted because of financial difficulties or other personal vulnerabilities.

The service also identified methods allegedly used to conceal movements, payments and communications.

These include encrypted messaging applications, telephone numbers registered outside the country of operation and accommodation or transport arrangements booked under other identities.

Such methods can complicate investigations because the individuals physically carrying out an operation may have limited knowledge of the organisers.

Romanian authorities emphasised that individual indicators should be assessed in context and do not themselves prove involvement in sabotage.

Defence factories become a security concern

The case has implications beyond Romania.

European governments are investing in ammunition production, air defence systems and military technologies, partly in response to the continuing war in Ukraine.

The resulting expansion of manufacturing capacity creates additional infrastructure requiring protection.

Industrial sites may be vulnerable not only to direct attacks but also to disruption affecting nearby businesses, transport networks, power supplies and specialist contractors.

The Brașov investigation illustrates how an incident outside a defence factory’s perimeter can nevertheless raise questions about the security of the wider industrial complex.

It also demonstrates the importance of cooperation between European intelligence services and criminal investigators.

The detention of suspects in Germany and the identification of another in Poland show that investigations into alleged sabotage may cross several jurisdictions.

The wider European response

Romania’s allegations come amid growing concern over hostile activities involving cyberattacks, disinformation, surveillance and physical sabotage.

Attributing such incidents to a foreign government requires intelligence assessments, criminal evidence and international cooperation.

The public allegations against Russia do not replace the judicial process concerning the three suspects.

However, the investigation has already prompted a diplomatic response and additional scrutiny of industrial security.

For European governments seeking to expand their defence industries, the immediate challenge is protecting production facilities and associated infrastructure without allowing relatively small-scale disruptive operations to undermine wider manufacturing programmes.

The outcome of Romania’s criminal proceedings will be important in establishing the responsibility of those accused and clarifying how the alleged network operated across national borders.

Main Image: By MAPN – http://www.mapn.ro/fotodb/20051020_expomil?page=1, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=14997305

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.

Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.

According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.

The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.

On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.

Crosetto warns of hybrid warfare through social media

Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.

Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.

His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.

Russian information operations under scrutiny

European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.

These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.

The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.

France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.

For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.

Meloni introduces tougher security legislation

Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.

The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.

Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.

New demonstrations test the government’s response

Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.

According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.

On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.

The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.

For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.

Latvia has called for a European Union-wide ban on tourist visas for Russian citizens, reopening a dispute between member states over border security, freedom of movement and the treatment of Russian nationals during Moscow’s continuing war against Ukraine.

Prime Minister Andris Kulbergs is pressing Brussels and other European capitals to adopt a common approach, arguing that continued visa issuance by some Schengen countries weakens restrictions imposed by states bordering Russia.

His intervention comes amid growing concerns over suspected Russian sabotage, espionage and other hostile activities across Europe. The Latvian government regards restrictions on non-essential travel as an additional measure to reduce potential security risks.

According to details of the Latvian proposal, Kulbergs has criticised the continued issuance of tourist visas by countries including France, Italy and Spain, maintaining that the consequences extend beyond the states granting entry.

The proposal would go considerably further than the restrictions already introduced by the EU since Russia launched its full-scale invasion of Ukraine in February 2022.

A divided European visa policy

The European Union suspended its visa facilitation agreement with Russia in September 2022, ending the preferential conditions previously available to Russian applicants.

The Council’s original decision introduced more demanding documentation requirements, higher application fees and stricter scrutiny, but it did not prohibit Russian citizens from obtaining short-stay visas.

National authorities therefore retained considerable discretion when assessing applications, subject to common Schengen rules.

In November 2025, the Commission introduced additional restrictions on multiple-entry visas, requiring Russian travellers covered by the new rules to apply again for subsequent visits.

The EU has also agreed a legal basis for restrictions targeting Russian military personnel and former combatants involved in the invasion of Ukraine, although implementation requires further measures.

Latvia argues that these steps remain insufficient because ordinary tourist visas continue to be available through some European consulates.

Once admitted to the Schengen area, a visitor can generally travel between participating countries without routine internal border checks. This creates difficulties for governments seeking to enforce stricter national entry policies.

Security concerns on the eastern border

Latvia shares borders with Russia and Belarus and has repeatedly warned that Moscow’s activities present risks extending beyond conventional military threats.

European governments have investigated incidents involving suspected sabotage, cyber operations, intelligence gathering and interference with transport infrastructure.

Such concerns have intensified following drone incursions and security alerts affecting NATO’s eastern members.

These concerns were also evident in EU Today’s reporting on suspected security breaches in Europe, although the circumstances of individual incidents must be investigated rather than assumed to involve foreign intelligence services.

The distinction is relevant to the Latvian proposal. European intelligence agencies have identified Russian-linked activities, but this does not establish that ordinary Russian tourists are collectively involved in intelligence operations.

Supporters of tighter visa restrictions argue that limiting discretionary entry could reduce opportunities for hostile activity and simplify security screening.

Opponents question whether a nationality-based prohibition would be proportionate or effective, particularly when intelligence operations may involve individuals travelling under other nationalities or using established residency arrangements.

Political and legal complications

A comprehensive tourist visa ban would require agreement on its precise scope, legal basis and implementation.

European governments would need to determine how the restrictions apply to Russian citizens with family members in the EU, people travelling for humanitarian purposes and individuals seeking protection from the Russian authorities.

The EU Visa Code already permits refusals where applicants present security risks, but a general prohibition based on nationality would involve a different policy decision.

Humanitarian exceptions would be particularly important for Russian dissidents, independent journalists and other individuals facing political persecution.

France has supported restrictions on entry by Russian combatants, while other member states are considering further measures. That does not necessarily mean they support Latvia’s broader proposal covering ordinary tourists.

Kulbergs is also seeking greater European financial assistance for countries facing the economic and security consequences of their proximity to Russia and Belarus.

Sanctions and Schengen controls

The renewed visa debate coincides with disagreements between Washington and Brussels over economic restrictions on Moscow.

EU leaders have maintained that sanctions should remain in place until Russia ends its aggression against Ukraine. Visa policy, however, requires separate legal and political consideration from economic sanctions.

Latvia’s proposal has not been adopted as an EU-wide rule. The immediate question is whether enough member states are prepared to move from tighter individual screening towards a general restriction on Russian leisure travel.

Until that agreement is reached, European countries will continue to apply different policies within a shared Schengen system, leaving the security concerns raised by Riga unresolved.

An apparent vehicle breach at Leipzig/Halle Airport has renewed questions about infrastructure protection. After an earlier drone incident blamed on Russia, Germany faces the challenge of responding firmly while allowing evidence to determine responsibility.

A damaged airport fence would ordinarily be a local policing story. At Leipzig/Halle, it carries a heavier significance. Following an attempted drone attack earlier this year, another security incident inevitably raises questions about whether Germany can adequately protect infrastructure operating in an increasingly hostile environment.

Yet the central distinction remains essential: an apparent perimeter breach is under investigation. Its cause, purpose and perpetrators have not been established. The implications deserve scrutiny; suggestions of another foreign operation remain speculation.

Police said damage was discovered shortly before 11pm on Saturday, October 17th. The northern runway was closed while federal and state officers searched the grounds. In a Sunday morning update, investigators said a vehicle had most probably broken through the fence. Initial searches found neither unauthorised people nor suspicious objects, with further searches planned.

Those findings provide reassurance without resolving the incident. Investigators still need to establish how the damage occurred, whether anyone entered restricted areas and whether the apparent breach was deliberate. Until those questions are answered, describing it as sabotage would run ahead of the evidence.

The operational picture also requires proportion. Although the northern runway remained closed, airport spokesman Uwe Schuhart said on Sunday morning that passenger and freight flights were continuing without restrictions because the second runway remained available. This was a significant security response, but not an airport-wide shutdown.

That distinction matters politically. Public confidence depends on authorities explaining both the seriousness of a suspected intrusion and the effectiveness of arrangements that keep essential services functioning.

Leipzig’s recent history nevertheless makes heightened vigilance understandable. Reuters recalled that investigators discovered an explosive-laden drone near a runway in August. German officials subsequently attributed responsibility to Russia, which denied the allegations. No connection between that episode and the latest fence damage has been established.

The earlier incident changes the context in which airport authorities must make decisions. Once a location has faced a potentially lethal threat, uncertainty becomes more expensive. An unexplained opening in a perimeter cannot be treated casually simply because the first search produces nothing suspicious.

This creates an uncomfortable imbalance. Damage that takes little time to inflict can require extensive searches, specialist personnel and precautionary closures. Whether caused by criminality, recklessness or hostile intent, a breach can impose costs far beyond the price of repairing a fence.

The wider German security debate gives those concerns additional weight. On October 12, Reuters reported warnings from Interior Minister Alexander Dobrindt about a “shadow war”. Domestic intelligence chief Sinan Selen described Russian activities encompassing disinformation, sabotage and assassination preparations, and said he expected further incidents resembling the earlier Leipzig drone episode.

Those warnings justify preparedness. They do not establish who damaged this fence. Conflating the two would weaken public understanding and risk turning every unexplained incident into an assumed act of geopolitical aggression.

For policymakers, the practical questions are more useful than premature attribution. How quickly was the damage detected? Could security personnel reconstruct movements around the affected area? Were protective measures proportionate to the risks? And what improvements, if any, would reduce the interval between a breach and a reliable assessment?

The airport’s continued operation offers one encouraging lesson: resilience includes maintaining service while investigating danger. A second runway provided operational flexibility. Similar thinking should guide investment across critical infrastructure, where preventing every disruption may be impossible but limiting its consequences remains achievable.

There is also a clear accountability test. Once investigators establish what happened, authorities should explain the findings and any resulting changes without revealing details that would assist future intruders. An accident, an ordinary crime and a hostile operation would demand different responses.

For now, Leipzig presents a warning about vulnerability rather than proof of another attack. Germany needs the capacity to investigate rapidly, protect exposed facilities and sustain normal life under pressure. Its credibility will depend on demonstrating those capabilities—and maintaining the discipline to distinguish justified suspicion from established fact.

Main Image: WikiABG

Explosive Drone Discovery at German Airport Exposes Europe’s Growing Hybrid Security Challenge

Poland has launched a nationwide security operation after three knife attacks at educational institutions left one woman dead and more than a dozen people injured. Police have detained 117 people amid a wave of online threats, while intelligence officials are examining whether Russian disinformation networks exploited the violence to spread panic.

Poland is confronting an unprecedented school security crisis after a succession of violent attacks by young people triggered widespread fear, school closures and a nationwide police mobilisation. By Sunday, 11 October, officers had detained 117 people and conducted nearly 64,000 security checks at educational establishments, as the authorities attempted to contain both genuine threats and an escalating campaign of intimidation on social media.

The crisis reached its height on Friday, 9 October, when warnings circulated about a supposed nationwide killing campaign known as “Bloody Friday”. Videos, threatening messages and lists of potential targets spread through TikTok, messaging platforms and school discussion groups, prompting parents to keep children at home and several local authorities to suspend classroom teaching.

Although police have found no evidence of an organised nationwide conspiracy, the violence that preceded the rumours was real. Three separate attacks took place between 7 and 10 October, while investigators are examining hundreds of other incidents involving threats or suspected criminal activity.

Two attacks that triggered nationwide panic

The first major incident occurred on Wednesday, 7 October, at a vocational school in Ostrołęka, north-east of Warsaw. A 19-year-old student armed with a machete attacked pupils, teachers and other people in and around the building, injuring nine victims before harming himself.

Investigators subsequently discovered a homemade explosive device inside his backpack. The suspect was arrested, and prosecutors brought nine charges against him, including attempted murder. The discovery of explosives raised further questions about the extent of his preparations and the possibility of a substantially higher death toll.

The following day, a 15-year-old former pupil entered a primary school in Leszczydół-Nowiny, near Wyszków, and attacked three members of staff with a knife. A 37-year-old caretaker died from her injuries, while two teachers, including the headteacher, were wounded.

According to investigators, the teenager wore a helmet-mounted camera, raising suspicions that he intended to record the assault. The official prosecution statement confirmed the victim’s death and the detention of the suspect.

The attacks were followed by threatening messages from other teenagers, including a video attributed to a 17-year-old in the Przasnysz district who claimed to be participating in a competition involving killings. Police subsequently detained him. In Sierpc, another 17-year-old was arrested after allegedly discussing plans for violence at school; officers discovered two knives.

Thousands of schools under police surveillance

The rumours produced an immediate reaction. Schools in Wyszków, Ciechanów, Pułtusk and other municipalities cancelled classroom teaching or introduced remote lessons. Elsewhere, parents independently withdrew their children, leaving some classrooms largely empty.

Police launched an extensive preventive operation, deploying additional officers around schools and investigating online threats.

According to the figures released on 11 October, the authorities had recorded 275 incidents requiring investigation, detained 117 people and carried out nearly 64,000 checks at schools, nurseries and other educational facilities.

The situation deteriorated further on Saturday, 10 October, when a 21-year-old student attacked three people at a post-secondary educational institution in Warsaw. Two 17-year-old girls and a 24-year-old woman were injured. One victim required hospital treatment, although none of the injuries was considered life-threatening.

Interior Minister Marcin Kierwiński subsequently stated that investigators had established no links between the recent attacks. The authorities nevertheless remain concerned about imitation offences, particularly where threatening material circulates among teenagers through closed online communities.

Russia’s possible role in spreading panic

The events have also raised questions about whether hostile foreign actors deliberately amplified the crisis. Tomasz Siemoniak, Poland’s minister responsible for coordinating the intelligence services, warned that Russian organisations routinely exploit domestic emergencies to spread disinformation and undermine confidence in public institutions.

In his statement on 9 October, Siemoniak acknowledged the possibility of foreign involvement but stressed the need for evidence before assigning responsibility.

There is, at present, no publicly established evidence that Moscow organised the school attacks or directed the subsequent threats. Nevertheless, the rapid circulation of alarming videos, fabricated warnings and unverified target lists illustrates how genuine violent incidents can be exploited to disrupt everyday life without further physical attacks.

The episode also presents a challenge for European regulators. Poland is examining measures against dangerous online content, while its existing obligations under the EU Digital Services Act provide a framework for addressing systemic risks associated with major platforms.

For Donald Tusk’s government, the immediate priority is preventing further attacks as schools reopen under heightened security. The longer-term challenge concerns the interaction between online radicalisation, copycat violence and disinformation capable of transforming isolated crimes into a national emergency.