A warning from Lithuania’s security services helped prevent an attempted arson attack at a site housing Starlink equipment on 18 October 2026. The incident followed fires at comparable ground stations in Poland and Bulgaria, raising the possibility that infrastructure supporting communications for Ukraine is being tested as a target across the European Union.
Investigators found 10-litre canisters containing flammable substances at the Lithuanian company. The intended fire did not take hold, and officials have not publicly established who was behind the attempt. Prime Minister Mindaugas Sinkevicius linked it to possible action by Russian services and described it as a potential part of a wider hybrid campaign against European democracies. Defence Minister Robertas Kaunas confirmed that a sabotage attempt had occurred, while stressing that the investigation was still under way.
The ground is the exposed part of the network
The site supports nine Starlink antennas, according to the Lithuanian government. Officials said they are used for communications that assist Ukraine in resisting Russia’s armed aggression. That gives the location significance beyond the protection of a private industrial facility: damage there could have affected a communications link with wider military and strategic importance.
Starlink is not simply a constellation of satellites in orbit. Ground stations, antennas, power supplies and control systems connect the satellite network to regional infrastructure and users. Destroying one station would not necessarily disable the wider service, but it could cause local disruption, complicate maintenance and force operators to rely on alternative arrangements.
Those facilities may also be easier to identify and reach than spacecraft. They can be placed on civilian or industrial sites, where security measures are designed for ordinary commercial risks rather than a deliberate attack. An intruder with fuel, access to an electricity supply or knowledge of the site’s layout could cause disproportionate damage without launching anything resembling a conventional military strike.
The Lithuanian case demonstrates the value of intelligence shared before an attack. The warning gave the company time to prepare and helped prevent the flames from reaching the antennas and other equipment. It may also have preserved physical evidence for investigators. But advance notice is not a substitute for permanent protection of facilities whose strategic importance is not necessarily obvious from their appearance.
Three incidents in a matter of weeks
The first known case in the sequence occurred in Poland on 23 September, when a Starlink ground station was hit by fire. On 16 October, the German magazine Der Spiegel reported that members of the Turkish criminal group Daltons had probably set the fire on behalf of Russian intelligence services. That account describes a reported investigative theory, not a fact conclusively established in the information available.
After the Polish fire, Deputy Prime Minister and Digitalisation Minister Krzysztof Gawkowski said that “many signs” indicated the incident was consistent with a new Russian doctrine of hybrid attacks. His statement reflected the Polish government’s assessment of the available indications, but did not by itself establish the identity of the perpetrators.
Bulgaria reported another fire on 14 October at a Starlink ground station near Sofia. Plamen Tonchev, head of the country’s State Agency for National Security, said he was convinced that the incident was sabotage. The available information does not provide a final public conclusion about who carried it out or whether it was connected to Russia.
The chronology is difficult for security agencies to ignore: a fire in Poland in late September, another in Bulgaria in mid-October and a foiled attempt in Lithuania four days later. The sites involve similar types of infrastructure, which could indicate a recurring method or a shared interest in these facilities. The sequence alone, however, does not prove common coordination, a single command structure or Kremlin involvement. Forensic findings, links between possible suspects and the origin of the incendiary materials will matter more than the timing by itself.
The problem of intermediaries
The Polish reporting raises a particularly difficult possibility: criminal networks could be used as local operatives for a remote sponsor. In such a scenario, the people carrying out an attack might know only the target and the method, while an alleged organiser remains in another country and communicates through intermediaries.
That model would complicate the distinction between organised crime and an operation directed by a state. It remains an investigative scenario, not proof that a criminal group or Russian service was involved in all three incidents. Police would need to compare travel records, communications, surveillance footage, financial links and traces left by the substances used. National security agencies, police forces and private operators would also need to share information quickly.
The physical security task extends well beyond fences and cameras. Antennas, electricity supplies, backup systems, control equipment and access roads form part of the same risk perimeter. Digital defences cannot prevent an attacker from placing fuel beside an antenna, cutting power or entering a poorly protected compound.
A test for European resilience
Lithuania, Poland and Bulgaria face a dual challenge. They must protect installations whose disruption could affect users beyond national borders, particularly when the infrastructure supports communications used by Ukraine. At the same time, officials must distinguish intelligence assessments and political warnings from evidence capable of establishing responsibility in court.
The cases will also test how quickly European countries can share information. A warning passed from one security service to another might identify a target, a method or a network before an attack takes place. Comparing the incidents could show whether their similarities reflect a coordinated campaign or a series of separate acts against exposed sites.
The Deutsche Welle report on the Lithuanian incident captures the central tension: the fire was stopped, but the vulnerability remains. Europe’s satellite communications depend not only on what is in orbit, but also on fixed facilities that can be reached on the ground. Whether the three cases form one organised effort or remain separate investigations will determine if governments respond with site-by-site security measures or a broader overhaul of protection for strategic communications infrastructure.
