America 2.0 · Closed tracker
Read America 2.0 →

Starlink Sabotage in Europe

Opened October 14 · Closed October 22 · Ran 9 days
An aerial view of a fenced compound with rows of white dome-covered antennas beside farm fields and a railway.
A Starlink gateway near Merrillan, Wisconsin, in 2024. Ground stations like this link the satellites to the internet (illustrative; not one of the attacked sites). Photo: Wikideas1 / Wikimedia Commons (CC0)

Arsonists have hit two European ground stations that link Starlink's satellites to the internet: in Poland on September 23 and near Sofia, Bulgaria, on October 9. Ukraine's armed forces depend on Starlink. Poland says Russian intelligence ordered its attack and has had four people detained in Germany; a Sofia court has issued European arrest warrants for two German citizens charged in absentia, but Bulgaria has not tied the attack to any state (AP; DW). This page tracks what is confirmed, who is claiming what, and what evidence would settle it.

This tracker closed on October 22, 2026. The Starlink attacks are part of a wider run of sabotage across Europe that four governments now blame on Russia. We follow them all on Is Russia Waging Hybrid War on Europe?

What the evidence shows

  • Arsonists hit Starlink ground stations in Poland (Sept. 23) and near Sofia (Oct. 9); an attempt at a Lithuanian firm storing Starlink equipment was foiled on Oct. 18.
  • Polish prosecutors cite “reasonable suspicion” that Russian services ordered the Polish attack; four people are detained in Germany.
  • Lithuania’s prime minister blames Russia for the attempt near Vilnius.
  • Bulgaria has charged two German citizens in absentia but has not named any state.
  • No charges naming a Russian service have been filed, and no outage from the attacks has been reported.

What would reopen it

Closed trackers reflect our provisional conclusion. We may reopen this one at any time if our editors see that new information has become available. The page and its sources stay online as a record.

Is it Russia? Strength of the attributionUpdated
LIKELYA third arson attempt, in Lithuania, is foiled; Poland and Lithuania blame Russia, Bulgaria names no one

Arsonists have hit Starlink ground stations in Poland (September 23) and near Sofia (October 9). Polish prosecutors cite “reasonable suspicion” that Russian services ordered the Polish attack, ministers say they have “no doubt,” and four people have been detained in Germany. But no evidence of a Russian link has been published, and no one has been charged in the Polish case. Bulgaria has charged two German citizens in absentia and issued European arrest warrants, but has not named any state behind the attack.

UnprovenClaims and accusations only; no official attribution.
LikelyOfficials point to Russia; the evidence is not yet public.
AttributedCharges or court filings name a Russian service, with evidence.
ConfirmedA court finding or independent confirmation.

What would change this rating ↓

starlinksabotage.america2.news

Get America 2.0 in your inbox

Analysis of Russian influence, information warfare and the networks behind them. Free; unsubscribe anytime.

Latest reports

New reporting from major outlets and official sources, listed as it appears. Our monitoring adds headlines from major outlets automatically. "Checked" means our software fetched the full report and confirmed it supports its headline. "Reviewed" means an editor checked it against its source. "Auto" items have not been checked yet. Tap a label for our note. None of this is an endorsement. Our assessment is the rating above.

All 42 sources →

What would change this assessment

The rating measures how well the claim that Russia is behind these attacks is supported by evidence, not how plausible it seems. Any one of these would move it.

  • not seenCharges with evidence: a Polish indictment or court filing that names a Russian service, handler or payment, or details disclosed at the suspects' extradition hearings in Germany.
  • not seenA Bulgarian finding: prosecutors or the State Agency for National Security naming who set the Sofia fire and on whose behalf.
  • not seenA link between the cases: an official statement tying the Polish and Bulgarian attacks to the same network.
  • not seenAllied attribution with evidence: the EU, NATO or another government attributing the attacks and citing intelligence it can describe.
  • not seenA claim or a specific denial from Russia, or from the suspects in court.
  • seenAnother attack on a Starlink or satellite ground station in Europe. On Oct. 18 an attempt to burn satellite antennas and a control unit at a Lithuanian firm storing Starlink equipment was foiled (LRT).

What is actually known

  • Poland: arson at a Starlink ground station. On the evening of September 23 a fire hit the power system and backup generator at a ground station at Wola Krobowska, south of Warsaw, owned by the state telecom operator Exatel and used to carry Starlink traffic, including to Ukraine. The station kept operating (Al Jazeera, The Local). Two days later Poland's National Prosecutor's Office said the fire “was the result of arson” and that there was “reasonable suspicion that the perpetrators acted on the orders of the Russian special services,” aiming to disrupt Starlink in Poland and other Central and Eastern European countries; at that point no one had been charged (PAP).
  • Four people detained in Germany. On October 12 Prime Minister Donald Tusk announced that two Turkish citizens had been detained in Germany at Poland's request, calling it “another act of hybrid warfare” (Notes from Poland). Poland's police chief said investigators have records of their movements, recordings, fingerprints and DNA (Notes from Poland). A woman and a man were later detained in Berlin; Polish radio reported that the woman may have driven the two men (The Local). The suspects are expected to face charges of sabotage on behalf of a foreign intelligence service (Al Jazeera).
  • Poland's ministers name Russia, but the evidence is not public. “We have no doubt that Russian services are behind this act of sabotage,” said Tomasz Siemoniak, the minister coordinating the special services, adding that Russia increasingly uses “individuals linked to the criminal underworld” (Al Jazeera). No handler, payment or recruitment channel has been published, and no court has ruled.
  • Bulgaria: Starlink antennas burned near Sofia. An opposition MP first revealed the fire, saying 11 of 17 Starlink antennas at a site near Sofia had been set alight by two masked men. On October 14 Prime Minister Rumen Radev confirmed an arson investigation, “extremely intensive” and run with partner services, and asked the head of the national security agency not to disclose details. Asked why he would not name Russia, he said: “everything is clear to us, but the investigation must be completed” (Sofia Globe). At a Sofia court hearing on Oct. 19, the court heard that three antennas were destroyed, two partly burned and three damaged, and that the fire risked spreading to the site’s administrative building. The two accused, German citizens born in 2007, entered Bulgaria as tourists at 5:37 a.m. on Oct. 9 and left for Serbia at 11:55 p.m. that night. Defence lawyers said the camera footage shows only silhouettes (Marica; Stolica). The court’s ruling is not final.
  • Ukraine warned of exactly this. In early October Ukraine's military intelligence told partners that Russian services planned sabotage in EU and NATO countries and named “Starlink satellite internet receiving stations located in European countries” among potential targets (Liga). A warning of intent, not evidence about either fire.
  • Moscow has said it wants Starlink stopped. Former space chief Dmitry Rogozin wrote in July that destroying Starlink would end the war in two to three weeks (Euromaidan Press). In August Tsargrad’s owner, Konstantin Malofeev, relayed Sergey Glazyev’s call to disable the enemy’s communications satellites, “including the notorious Starlink constellation,” and to cut communications on land and under the sea (Tsargrad, archived; our translation). On Oct. 4 Dmitry Medvedev, deputy head of Russia’s Security Council, warned that if Russia’s own Rassvet satellite network were blocked, “their low-orbit Starlink satellites would come tumbling down like ornaments from a dried-up Christmas tree” (Yeni Şafak). A leaked 2023 Russian-Chinese plan escalates from regulatory pressure and jamming to cyberattacks and destroying satellites (The Insider). None of these names ground stations. They record intent, not evidence about the fires.
  • Lithuania: a foiled arson attempt. At about 02:00 on October 18, someone tried to burn “satellite antennas and a control unit” at a Lithuanian company storing Starlink equipment, Prime Minister Mindaugas Sinkevičius said. Security services had warned the firm, which had stepped up security, and the attempt failed; incendiary liquids were found in containers of three to 10 litres. He said “it is likely that it is already clear who commissioned it – it is the Russian side,” and tied it to similar incidents in Poland and Bulgaria. A pre-trial investigation is open; no suspects have been reported detained (LRT). Foreign Minister Kęstutis Budrys said the target was Starlink infrastructure near Vilnius and its purpose “to undermine a capability critical to Ukraine’s defence and civilian communications,” calling it a direct consequence of Russia’s war against Ukraine (X: Budrys). Vilmantas Vitkauskas, head of the National Crisis Management Centre, said it “was not a routine arson attack but an act of sabotage,” linked to earlier arson attacks on Starlink stations in Bulgaria and Poland: “Ukraine is the target” (Reuters). After the National Security Commission met on Oct. 19, Sinkevičius said attackers used incendiary liquids and Molotov cocktails; “the antennas did not catch fire; the control unit was slightly scorched.” SpaceX rents the premises from a Lithuanian company, and the head of the crisis centre said a successful attack would probably have disrupted communications. Lithuania is raising the alert level at more than 15 critical-infrastructure sites and assigning troops to guard them (Delfi/ELTA).
  • Russia has not answered. The Russian embassy in Warsaw did not reply to Al Jazeera; Moscow has dismissed similar accusations in the past as baseless (Al Jazeera).

Claims in circulation

The most-shared claims, and what public sources can confirm.

Partly confirmed

Two men with German passports were arrested for the Sofia fire

Origin. Bulgarian outlets citing unnamed prosecution sources (Sega).

What the evidence shows. No named official has confirmed any arrest. Radev and the security agency have said only that the investigation is under way (Sofia Globe).

Bottom line. Partly confirmed: a Sofia court issued European arrest warrants for two German citizens on Oct. 19; no arrest has been reported (AP; DW).

Likely, not shown

Poland has proved Russia ordered the attack

Origin. Headlines on October 12–13 after Polish ministers named Russia.

What the evidence shows. Prosecutors cite “reasonable suspicion,” and ministers say they have “no doubt” (Al Jazeera). Police say they hold movement records, recordings, fingerprints and DNA on the suspects (Notes from Poland), but nothing tying them to a Russian service has been published, and no charges have been filed.

Bottom line. An official attribution, not yet a proven one.

Unconfirmed

The Polish and Bulgarian attacks were carried out by the same network

Origin. Media reports that investigators are examining a possible link.

What the evidence shows. No Polish or Bulgarian official has said the cases are connected.

Bottom line. Possible, not established.

Officials’ stated aim

The attacks aim to degrade the Starlink service Ukraine depends on

Origin. Polish, Lithuanian and Bulgarian officials.

What the evidence shows. Polish prosecutors say the aim was to disrupt Starlink in Poland and other Central and Eastern European countries (PAP). Lithuania’s foreign minister says the purpose was “to undermine a capability critical to Ukraine’s defence” (X: Budrys); its crisis chief says “Ukraine is the target” (Reuters). So far the damage is small: the Polish station kept operating (The Local), the Lithuanian antennas did not catch fire, and the crisis chief noted that other such stations exist (Delfi/ELTA). Low-cost physical attacks using hired criminals fit the wider pattern of Russia-linked sabotage in Europe (Al Jazeera).

Bottom line. The stated aim of the officials naming Russia. The effect on service so far appears limited.

Plausible, unproven

The attacks are meant as leverage over Elon Musk and SpaceX

Origin. Posts on X after the Lithuanian attempt (X), and the logic of Russia’s own public statements.

What the evidence shows. Prominent Russian voices have treated Musk, not Washington, as the person who decides what Starlink does. In August Konstantin Malofeev, the owner of Tsargrad, wrote that “it is not hard to put pressure on Musk.” He quoted the Russian official Sergey Glazyev calling for cutting communications “on land and on the seabed” as well as disabling Starlink’s satellites, and he described SpaceX’s investors as backers of the war against Russia (Tsargrad, archived; our translation). In September the Kremlin’s spokesman called letting Ukraine use Musk’s systems for deep strikes “very harmful, potentially dangerous and reckless” (Interfax). Musk says the US government controls Ukraine’s military service, but the Wall Street Journal, citing US officials, reports that Musk himself ordered the October slowdown (WSJ); the Telegraph had reported that he proposed it to President Trump (Kyiv Independent). No official has tied the arsons to a demand on SpaceX, and SpaceX has not commented.

Bottom line. If Russia is behind the attacks, pressure on SpaceX is a logical motive. No document shows it yet.

What to watch next

  • Extradition hearings in Germany and formal charges in Poland, which could make the evidence public.
  • Whether Germany arrests the two Bulgarian suspects, and whether Bulgaria’s parliament holds the hearing the opposition Democratic Bulgaria demanded on Oct. 20 into how they left the country (News.bg).
  • Any official statement linking the two attacks, or naming a handler or recruitment channel.
  • Further attacks on satellite ground stations, and any statement from SpaceX on how they affect service.
  • Arrests or charges in Lithuania, where no suspect has been reported detained.

Timeline

  • Sep 23Fire at the Starlink ground station at Wola Krobowska, Poland (The Local).
  • Sep 25Polish prosecutors open a sabotage investigation and cite “reasonable suspicion” of Russian orders (PAP).
  • Early OctUkraine's military intelligence warns that Starlink ground stations in Europe are potential Russian targets (Liga).
  • Oct 9Starlink antennas burned at the Plana teleport near Sofia (Sofia Globe).
  • Oct 12Tusk announces two Turkish citizens detained in Germany; Siemoniak: “no doubt” Russia is behind it (Al Jazeera).
  • Oct 13Two more people detained in Berlin (The Local).
  • Oct 14Radev confirms the Bulgarian arson investigation (Sofia Globe).
  • Oct 16Der Spiegel, citing sources in several countries, reports the two Turkish suspects may belong to, or have been hired by, the Turkish crime gang known as the Daltons, which it says Russian intelligence may have commissioned; a court in Stuttgart will decide on extradition to Poland (Meduza, Euronews).
  • Oct 18An arson attempt at a Lithuanian firm storing Starlink equipment is foiled; the prime minister blames Russia (LRT).
  • Oct 19A Sofia court approves European arrest warrants for two German citizens charged in absentia; they left Bulgaria the night of the fire (AP; Marica).
  • Oct 19Lithuania raises security at more than 15 critical-infrastructure sites after the National Security Commission meets (Delfi/ELTA).

Key sources

All 42 sources →Every report we have listed, every source cited on this page, background reading, and the sources we cite only with caution.