Baltic Security Monitor | Analytical Brief As of 3 September 2026, 20:00 EEST

Denmark's Security and Intelligence Service (PET) says Russian intelligence services are actively preparing sabotage operations against Danish defence companies linked to military assistance for Ukraine. PET's head of counterintelligence, Emil Græsholm, told the newspaper Berlingske that the planning uncovered had become concrete enough that the service considered a public warning necessary: "The selection of targets and the preparations are so specific that we believe it is necessary to go public with the message that this is a threat that must be taken seriously." He cited arson as one possible method of sabotage. In a written statement to AFP and Danish broadcaster TV2, PET confirmed: "The Russian intelligence services are actively preparing acts of sabotage targeting the defence industry in Denmark... It is directed against Ukrainian defence manufacturers in Denmark."

According to Græsholm, PET has uncovered concrete examples of Russia attempting to recruit "ordinary Danes" through social media and gaming platforms for tasks such as photographing companies or infrastructure, which could later be used in sabotage planning; people are sometimes recruited without being told they are effectively working for Moscow. "It is extremely serious if ordinary Danes assist Russian intelligence services — either deliberately or unwittingly," he said, adding that PET was disclosing details of the methods precisely because "they don't need to look like a spy movie" — meaning recruitment happens in mundane, low-key ways rather than through obvious tradecraft. PET assesses that the Russian threat will continue to grow "in scale and complexity." Russia's ambassador to Denmark denied the allegation, arguing that PET had not publicly provided evidence to support it.

The notable part isn't the warning of possible sabotage itself — PET already said publicly back in 2024 that the Russian threat to Denmark had grown, while explicitly noting it knew of no specific instances of physical sabotage on Danish soil at that time. What's new is that the 3 September statement moves the threat assessment from a general warning to a concrete intelligence finding about operational preparation already underway inside the country — with named methods (arson), recruitment channels (social media, gaming platforms), and identified categories of targets.

BSM analysis: the third storyline this week in one line

Denmark's warning doesn't arrive in a vacuum. It's the third storyline BSM has covered this week as part of a single continuous thread: first Germany officially attributed the attempted explosive-drone attack at Leipzig/Halle Airport to Russia, then the EU moved institutionally by summoning Russia's representative and preparing sanctions, and now another NATO member's intelligence service — this time Denmark's PET — is publicly describing active operational sabotage preparation on its own soil. Jakob Kaarsbo, a former chief analyst at Danish Defence Intelligence, noted that the public statement itself could serve as a signal to Moscow that Danish authorities are aware of its activities and monitoring them closely. He also suggested Denmark is likely a harder recruitment environment than some other countries — though that doesn't change the fact that concrete planning has been identified.

The recruitment method — using ordinary residents for seemingly innocuous reconnaissance — matters in its own right: it gives a foreign intelligence service access to defence infrastructure without directly deploying professional officers, making detection and attribution harder. Denmark is one of Ukraine's largest military donors: since the start of the full-scale invasion, it has provided Ukraine with at least €10 billion in military support and roughly €1 billion for civilian needs.

Why it matters for Ukraine and the Baltic region

Denmark is a major military backer of Ukraine, and PET specifically names defence companies tied to military assistance for Kyiv as targets of concern. The alleged Russian activity therefore directly touches part of the European industrial-logistics system sustaining Ukraine's war effort.

For the wider Baltic region, Denmark's disclosure strengthens the case that defence factories, logistics facilities, and related infrastructure across northern Europe are potential targets in Russia's hybrid campaign. It follows Germany's Leipzig/Halle attribution but carries independent weight: another NATO intelligence service is now describing active operational preparation on its own territory, not simply commenting on someone else's case. The recruitment method — through social media and gaming platforms — is a direct signal for the Baltic states too, where the same channels are just as accessible and just as hard to police preventively.

Bottom line

For now, only PET's attribution and the identified recruitment activity are public — the specific targeted companies, suspects, operational timelines, or underlying intelligence evidence have not been disclosed. The next indicator to watch is whether Danish defence companies tighten physical security and perimeter controls in response to the warning, whether PET and allied intelligence services uncover further recruitment attempts or links to a wider cross-border sabotage network, and whether the investigation leads to concrete arrests, expulsions, or new sanctions measures at the EU or NATO level.

Baltic Security Monitor (osint-baltic.com) — an analytical publication covering security on NATO's north-eastern flank. All OSINT indices are calculated by an automated indexing system based on open sources.