Baltic Security Monitor | Analytical Briefing Update as of 27 September 2026, 14:00 (Europe/Tallinn)

Polish prosecutors have taken a step that wasn't there two days ago: from a cautious "we are investigating arson" to a public statement of reasonable suspicion that Russian intelligence ordered the attack. This is not a court verdict, and no individual has been formally charged — but it is a significant shift in an official position from a NATO member state. If the theory holds, this is a physical sabotage strike on infrastructure supporting communications in Ukraine and the region, carried out on Alliance territory rather than remotely through a cyberattack.

What happened

On 23 September, a fire broke out at a Starlink satellite ground station in the village of Wola Krobowska, Masovian Voivodeship. Polish officials were initially cautious: Prime Minister Donald Tusk said the situation "doesn't look good" but withheld a definitive judgment on sabotage pending full confirmation. Deputy Interior Minister Czesław Mróček said at the time that CCTV footage pointed to arson.

On 27 September, Poland's National Prosecutor's Office substantially sharpened its language. Spokesman Przemysław Nowak said criminal proceedings had been opened regarding acts committed on 23 September in Wola Krobowska in the interests of a foreign intelligence service against Poland, along with sabotage and a terrorism-related offense involving arson at the Starlink ground station that caused significant property damage.

Nowak added that investigators now have reasonable grounds to suspect the perpetrators acted on the instructions of Russian special services and on behalf of a foreign intelligence service targeting Poland. According to the prosecutor's office, the aim was to disrupt Starlink's operation and internet connectivity in Poland and other Central and Eastern European countries (PAP, European Pravda, MILMAG, UNITED24 Media).

BSM Analysis: The key shift is not the sabotage suspicion itself — that was already on the table on 23–25 September — but the fact that the state has, for the first time, publicly named a probable sponsor: Russian intelligence services. Until now, investigators had withheld that formulation, citing the need for evidence. Moving from "possible sabotage" to "reasonable suspicion of Russian direction" raises the official attribution level, even without an identified perpetrator or a court finding.

Why it matters for Ukraine and the region

The target was ground infrastructure supporting satellite communications across Central and Eastern Europe, including Ukraine. Even before the prosecutorial upgrade, Polish Digital Affairs Minister Krzysztof Gawkowski had warned that disruption of the station could affect, among others, Ukrainian military users of the system.

If Russian involvement is substantiated, this becomes another instance of a physical — not cyber — strike against infrastructure supporting Ukraine, carried out inside NATO territory. For the Baltic region, the broader significance extends beyond one incident: the target class — satellite gateways, communications nodes, logistics facilities and other distributed infrastructure on NATO's eastern flank — shows that protecting such assets cannot rely on cyber resilience alone.

What to keep watching

🟡 A prosecutorial assessment is not a final judicial finding. As of publication, no one has been formally charged, and Russian intelligence direction remains an investigative theory, albeit one now backed by an official statement of "reasonable suspicion."

🟡 Investigators still need to establish a command chain — whether the arsonists can be directly linked to Russian state structures, and whether there is any connection to other suspected sabotage operations in Poland, including earlier railway sabotage cases.

The immediate operational impact should not be overstated: the station remained operational after the fire, and Wola Krobowska is neither Poland's only nor necessarily its most critical Starlink gateway.

Regional context

The incident fits a broader pattern of suspected hybrid operations against NATO infrastructure on the northeastern flank over the past year: railway sabotage in Poland, attacks on undersea cables and pipelines in the Baltic Sea, a cyberattack on a Polish power plant serving roughly half a million customers, and repeated warnings from Lithuanian and Latvian intelligence about possible false-flag provocations dressed up as Ukrainian. Lithuanian President Gitanas Nausėda has previously warned publicly of the risk of limited Russian operations against critical infrastructure in the Baltic states and Poland.

Against this backdrop, the Starlink station arson is not an isolated episode but another entry in a growing list of physical incidents complementing the cyber and maritime dimensions of hybrid pressure on NATO's eastern flank.

Conclusion

The main development of the day is not a new event but a shift in official rhetoric — from cautious ambiguity to direct, if still preliminary, attribution to Russian intelligence services. That raises the stakes for the investigation ahead: if a documented command chain can be established, this case would become one of the few publicly confirmed instances of physical Russian sabotage against a facility supporting communications with Ukraine, on NATO territory.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security along NATO's northeastern flank. All OSINT indices are calculated by an automated indexing system based on open sources.