France has deployed a maritime patrol aircraft to Romania following a series of attacks on civilian vessels near NATO territory. The escalating threat has prompted closer cooperation between Romania, Bulgaria and Turkey, raising questions about maritime security and the protection of Europe’s eastern flank.

A series of drone attacks on commercial shipping in the western Black Sea has brought the consequences of Russia’s war against Ukraine increasingly close to NATO territory, prompting additional military surveillance and renewed regional defence cooperation.

France has temporarily deployed an Atlantique 2 maritime patrol aircraft to Romania, while NATO members bordering the Black Sea are strengthening arrangements to monitor shipping routes, identify airborne threats and protect critical infrastructure.

The French aircraft began operating from Romania’s Mihail Kogălniceanu airbase on 18 October and is scheduled to continue reconnaissance missions until 6 November.

Its deployment follows repeated attacks on merchant vessels near Romania and Bulgaria, both members of NATO and the European Union.

At least eight cargo ships have been struck in the region during October, with approximately 34 sailors reported dead or missing, according to figures reported by Reuters on 27 October.

The incidents have transformed commercial maritime security into an increasingly urgent issue for European defence planners.

Commercial vessels enter the conflict zone

The latest escalation has centred on shipping routes serving Ukraine’s Danube ports and commercial traffic passing through the western Black Sea.

Russia’s attacks on Ukrainian maritime infrastructure have increased the importance of alternative export routes, including those connecting the Danube to international shipping lanes.

However, recent incidents demonstrate that geographical proximity to NATO territory does not necessarily provide commercial vessels with protection from the effects of the conflict.

On 23 October, a drone struck a Comoros-flagged cargo vessel near the Romanian port of Constanța.

According to maritime security company Ambrey, the vessel was hit approximately 16 nautical miles east of the port and subsequently capsized.

One crew member was reported dead, nine were rescued and three remained missing in the initial casualty figures.

Ambrey assessed it as highly likely that Russian forces carried out the attack, pointing to the vessel’s links with Ukrainian Danube ports.

That assessment represents an attribution by a commercial security organisation, rather than a final determination by an international investigative body.

Other incidents have similarly raised questions over responsibility.

Ukraine has accused Russia of attacking civilian shipping, while Bulgarian authorities have acknowledged difficulties in conclusively identifying the operators of drones involved in some strikes.

France strengthens maritime surveillance

Romania’s Defence Ministry announced on 27 October that the Atlantique 2 deployment followed a request from Bucharest in response to the deteriorating security situation.

The aircraft is conducting surveillance and reconnaissance over the western Black Sea, working with Romanian naval authorities and maritime rescue coordination services.

Its principal responsibilities include identifying hazards to navigation and improving awareness of threats to critical infrastructure within Romania’s exclusive economic zone.

That infrastructure includes offshore energy facilities and maritime installations whose protection is increasingly relevant to European energy security.

The deployment adds to Romanian naval patrols conducted by ships, helicopters and unmanned systems.

Romanian authorities are also providing navigational warnings and recommended routes to commercial vessels.

Nevertheless, additional surveillance does not automatically prevent attacks.

The practical challenge lies in detecting relatively small unmanned aircraft or maritime drones, determining their intentions and responding before they reach civilian targets.

Romania, Bulgaria and Turkey coordinate their response

The security crisis was also discussed at a trilateral meeting of defence ministers in Sofia on 28 October.

Romania’s Defence Minister, Ștefan-Radu Oprea, met his Bulgarian counterpart, Dimitar Stoyanov, and Turkey’s Defence Minister, Yaşar Güler, to examine the consequences of attacks on commercial shipping.

According to the Romanian Defence Ministry, the ministers discussed closer intelligence-sharing, improved maritime surveillance and better coordination between their naval forces.

They also reaffirmed the importance of the existing Black Sea mine-countermeasures initiative involving the three countries.

Maritime mines remain a persistent hazard because they can drift beyond their original deployment areas, endangering civilian vessels irrespective of their destination or ownership.

The trilateral format provides a practical mechanism for neighbouring countries to coordinate activities while retaining responsibility for their respective national waters.

It also gives Turkey a central role in regional discussions, reflecting its position on the Black Sea and its control of access through the Turkish Straits under the Montreux Convention.

The limits of NATO’s maritime protection

The attacks raise a complicated legal and operational question: what responsibilities do NATO members have when civilian ships are attacked near their coastlines?

The distinction between territorial waters and an exclusive economic zone is important.

A coastal state’s territorial sea generally extends up to 12 nautical miles from its baseline, while its exclusive economic zone can extend considerably further and confers particular economic and jurisdictional rights.

An attack within a NATO member’s exclusive economic zone does not automatically constitute an armed attack against that member’s territory.

Nor does every strike on a civilian ship near NATO territory automatically trigger the collective-defence provisions of Article 5.

The circumstances, attribution, location and consequences of an incident would all influence the response.

This creates a security problem in which threats can affect European economic interests without necessarily crossing a threshold requiring collective military action.

Maritime trade and energy infrastructure face increasing risks

The implications extend beyond individual vessels.

Repeated attacks can increase insurance costs, complicate shipping schedules and discourage operators from using particular routes.

They can also affect Ukrainian agricultural exports and the wider commercial networks linking Black Sea ports to European markets.

Offshore energy installations face related vulnerabilities, particularly where surveillance and response capabilities are insufficient.

For NATO, the challenge is therefore to strengthen deterrence and protection without unintentionally escalating the conflict.

France’s reconnaissance deployment and the trilateral cooperation between Romania, Bulgaria and Turkey indicate that regional governments are moving towards a more coordinated response.

However, the continuing attacks demonstrate the difficulties of protecting civilian maritime activity against comparatively inexpensive unmanned systems.

The longer-term question is whether increased surveillance, counter-drone capabilities and naval cooperation can make western Black Sea shipping sufficiently secure while the war in Ukraine continues.

Kyiv's Southern Bridge was struck by at least one Russian ballistic missile on the morning of Oct. 27, leaving a large hole in the structure and closing the bridge to both road and rail traffic.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.

The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.

HUR says Moscow wants to discredit Ukraine’s army

Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.

The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.

Potential targets include infrastructure and Russian Orthodox Church sites

HUR listed several potential targets for Russian provocations:

• critical infrastructure and areas bordering Russia;
• the Kaliningrad exclave;
• areas of EU countries with Russian-speaking populations;
• Kremlin-controlled sites, including properties belonging to the Russian Orthodox Church network;
• historical sites associated with Russia.

The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.

Earlier warnings and reported sabotage

On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.

Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.

Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.

According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.

The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.

Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.

France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.

European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.

France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.

Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.

The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.

France establishes a new approach

In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.

The legislation followed a series of reported drone incursions over sensitive locations, including military installations.

Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.

Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.

French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.

The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.

France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.

The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.

Germany and Austria reconsider existing restrictions

Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.

At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.

The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.

German authorities attributed the incident to Russia, an allegation Moscow denied.

The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.

Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.

The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.

Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.

Electricity networks face particular risks

Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.

Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.

A successful attack against critical equipment can produce consequences extending well beyond the immediate site.

Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.

European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.

The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.

Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.

European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.

Who bears responsibility for an interception?

Giving civilian operators access to counter-drone equipment raises unresolved legal questions.

Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.

Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.

A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.

European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.

There is no uniform European approach.

Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.

Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.

The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.

A growing European security market

The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.

Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.

Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.

German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.

However, the technology is advancing faster than the legal frameworks governing its use.

The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.

A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.

A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.

The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.

Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.

French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.

The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.

The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.

Refrigeration systems remotely manipulated

Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.

The French cybersecurity authorities identified compromises involving products supplied by Danish manufacturer Danfoss and American company Copeland.

Some of the affected systems used older equipment that no longer received regular security updates.

According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.

Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.

The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.

Several retailers managed to contain the damage, but others lost substantial quantities of stock.

The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.

The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.

Vulnerabilities in connected equipment

The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.

Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.

These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.

Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.

The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.

A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.

Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.

The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.

France’s delayed cybersecurity legislation

The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.

The directive establishes common requirements covering risk management, incident reporting, organisational responsibility and protection against cyber threats.

Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.

EU member states were required to incorporate the directive into national legislation by 17 October 2024.

France was among the countries that received a formal warning from the European Commission in May 2025 over incomplete implementation.

French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.

However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.

The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.

Wider implications for European infrastructure

The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.

Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.

The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.

The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.

The attack itself has been established, but responsibility for it has not been publicly attributed.

French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.

The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.

For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.

Russia has started fitting its enlarged Gerbera-2 drones with a 10-kg warhead and an extra bag of incendiary mixture, Ukrainian military outlet Militarnyi reported on 18 October. The setup is designed to start a fire where the drone hits and is probably meant for attacks on critical infrastructure and warehouses, the outlet said.

Russia’s industry makes about 3,000 jet-powered Geran-4 and Geran-5 drones a month, Ukraine’s military intelligence has said, and Russian strikes have destroyed 2.1 million m² of Ukraine’s modern warehouse space since the full-scale invasion began. A cheap drone that carries fire adds one more threat for air defenses that already let nearly half of Russia’s jet-powered Shaheds through.

A fire bag behind the warhead

Ukrainian Telegram channel Polkovnyk HSh posted photos of the payload on 17 October. Gerbera-2 strike and reconnaissance drones had begun to appear with a 10-kg high-explosive fragmentation-incendiary warhead and an extra package of incendiary mixture, the channel wrote. They navigate with Kometa-M12, a 12-element antenna array designed to resist jamming, it added.

In the photos, the incendiary mixture sits in a separate soft plastic tank behind the main warhead, Militarnyi said. Gerbera-2s have been seen with warheads of 4 to 10 kg depending on range, while strike versions of the original Gerbera usually carried up to 5 kg, the outlet noted.

Half a Shahed engine

Russia has mainly fielded the Gerbera, a cheap drone shaped like a Shahed, as a decoy and reconnaissance platform flying alongside Shahed-type strike drones. It has also used bigger Gerberas to drop FPV drones.

Serhii Beskrestnov, now an adviser to Ukraine’s president, flagged a much bigger Gerbera in Ukraine’s skies on 7 August. The Gerbera-2 has a larger airframe, a reshaped wing, and a bigger tail fin, Militarnyi said. In August, the outlet reported it had a stronger piston engine: half of the one in the Shahed-type Geran-2, at about 275 cm³. Production of these engines was set up at the Izhevsk Motorcycle Plant, according to preliminary information the outlet cited.

Earlier versions ran on a Chinese DLE60 model-aircraft engine of about 61 cm³. The switch was likely possible because Geran-2 engine output partly freed up as jet-powered Geran-4s took a growing share of Russia’s drones, Militarnyi said. The Gerbera-2’s fuel tank also holds up to 63 liters, against 10 liters on the original.

One reached Poland’s Baltic coast

In September, a drone preliminarily identified as a Gerbera-2 was recovered from the Baltic Sea near Rusinowo, on Poland’s coast. It carried a high-explosive fragmentation warhead of about 4 kg, a Polish military prosecutor said.

Ukrainian and Japanese officials discussed establishing backup bridge crossings in the event of Russian strikes, preparing municipal infrastructure for winter, and Japan's continued assistance with Ukraine's recovery, Ukraine's Minister for Restoration, Infrastructure and Transport, Mykola Kalashnyk, reported on 14 October.

Russia is targeting Kyiv's bridges to paralyze the city and break civilian morale, defense analyst Hamish de Bretton-Gordon wrote in The Telegraph. On 1 and 2 October, Russia attacked Kyiv's Southern Bridge, then struck the Northern Bridge on 3 and 4 October. Ukraine is now working with international partners to establish backup bridge crossings that could maintain connectivity even if major routes are damaged.

The discussions took place during a meeting between Minister Kalashnyk, Japan's Ambassador to Ukraine Yo Osumi, and Osamu Hattori, head of the Japan International Cooperation Agency (JICA) office in Ukraine, according to the statement.

Backup crossings could prevent logistical disruptions if major bridges are damaged

Kyiv's Southern Bridge, for example, plays a critical role in logistics because freight traffic uses it, transport planning expert Dmytro Bespalov noted in an article for Ukrainska Pravda. At the same time, installing additional metal structures to reinforce bridges could be dangerous given their technical condition and existing load levels, he said.

One potential solution is to establish backup bridge crossings.

Ukraine and JICA have agreed to continue working together on engineering solutions for setting up these crossings. Japan has already delivered 720 meters of prefabricated bridge structures to Ukraine, which are expected to be used to create alternative routes if Russia's attacks damage major bridges, Kalashnyk said.

The initiative is intended to help maintain transportation links, ensure the delivery of critical supplies, and preserve evacuation routes for civilians.

Ukraine prepares water utilities and boiler plants for winter amid the threat of Russian infrastructure strikes

During the meeting, Ukraine and JICA discussed equipping water utilities with backup power supplies, addressing the need for modular boiler plants, and obtaining equipment to ensure uninterrupted heating and water services. Ukraine has already submitted lists of the necessary equipment to JICA for consideration as part of a new emergency assistance project, Kalashnyk said.

An intercepted document outlining an alleged Russian plan for strikes against Ukraine this winter reportedly describes attacks on 60 critical infrastructure facilities using up to 1,000 missiles, drones, and aerial bombs. Potential targets include electrical substations, hydroelectric power plants, thermal power plants, boiler facilities, and infrastructure related to water supply and wastewater management.

The document also describes potential strikes on facilities in Kyiv, Kharkiv, Odesa, and several other cities. Such attacks could disrupt electricity, heating, water supply, and wastewater services.