Fires at a Bulgarian ammunition company and an Italian defence plant within three days have focused attention on the vulnerability of Europe’s military infrastructure as governments seek to rebuild depleted stocks.
On 10 August 2026, a fire spread across the EMCO site near Tryavna, Bulgaria, before an explosion at an ammunition warehouse. Three days later, a powerful blast struck the KNDS Ammo Italy plant about 40km from Rome, a facility that produces medium- and large-calibre shells and other military products. Neither incident has been officially confirmed as sabotage, but their timing and the strategic importance of the sites have intensified concern over the risks posed by Russian activity against Europe’s defence sector.
Two sites, two different investigations
Bulgarian authorities have offered a preliminary explanation for the EMCO explosion: a vehicle caught fire and the flames spread to the warehouse. The company and its owner, Emilian Gebrev, have nevertheless featured repeatedly in investigations into possible Russian intelligence operations. Gebrev survived an attempted poisoning in 2015, while Bulgarian prosecutors later examined the possible involvement of six Russian nationals in four explosions at Bulgarian ammunition warehouses and factories between 2011 and 2020.
Some of the sites involved in those earlier investigations stored ammunition intended for export to Ukraine and Georgia. Bulgarian law-enforcement bodies considered the incidents as possible elements of sabotage operations designed to destroy weapons stocks and disrupt supplies to countries Moscow viewed as opponents.
The circumstances at KNDS Ammo Italy remain unresolved. Preliminary information indicates that the fire began in the area where propellant was being pressed before the blast. The cause has not been officially established. Any prolonged interruption or reduction in production at a plant of KNDS’s importance would, however, affect the ability of Europe’s defence industry to supply artillery ammunition in sufficient quantities.
A pattern with an established precedent
Russia’s intelligence services have previously been linked to attacks on ammunition facilities in Europe. The clearest example is the Czech town of Vrbětice, where two ammunition warehouses exploded on 16 October and 3 December 2014. After a lengthy investigation, Czech law-enforcement and intelligence agencies connected the operation to Russian military intelligence and officers from a unit of Russia’s military intelligence directorate.
The earlier Bulgarian cases and the Vrbětice investigation do not establish that either of the August 2026 explosions was caused by Russian operatives. It would be wrong to treat every fire or blast at a European defence site as sabotage. They do show, however, that ammunition depots and production facilities have already been targeted in operations attributed to Russian intelligence, making any new incident at such a site a matter of wider security significance.
Europe’s depleted stocks increase the risk
The concern is heightened by the condition of European ammunition reserves. Stocks in many Nato countries have fallen in recent years, while defence manufacturers are only beginning to expand production on a large scale. Damage to individual sites could therefore have consequences beyond the immediate loss of equipment or temporary disruption to a factory: simultaneous incidents in several countries could reduce the capacity of the European part of the alliance to replenish its supplies.
Ukraine experienced the consequences of losing major ammunition reserves before Russia’s full-scale invasion. On 29 October 2015, an explosion at a warehouse in Svatove, about 100km from the then frontline, began after a fire and led to prolonged detonation. At least two people were killed, at least eight were injured and hundreds of buildings were damaged; investigators examined the incident as a terrorist act.
Further explosions began at the Balakliia arsenal in Kharkiv region on 23 March 2017 and at the strategic arsenal in Kalynivka, Vinnytsia region, on 26 September that year. About 138,000 tonnes of ammunition were stored at Balakliia, while Kalynivka held 83,000 tonnes, including about 63,000 tonnes considered fit for use. Explosions began at the sixth arsenal near Ichnia, Chernihiv region, on 9 October 2018. Ukrainian defence officials pointed to blasts occurring at intervals in different parts of the site as a clear sign of sabotage. Ukrainian authorities repeatedly investigated the 2015–18 incidents as possible operations by Russian services.
Sabotage as a strategic pressure tactic
The scale of Russia-linked activity in Europe has also grown. The Centre for Strategic and International Studies said the number of arson attacks and acts of sabotage associated with Russian activity rose from two cases in 2022 to 12 in 2023 and 34 in 2024. Western officials have cited 145 documented episodes of Russian hybrid activity in Europe, ranging from arson and infrastructure damage to cyber operations and the use of recruited operatives.
From a military perspective, weakening an opponent’s resources before a conflict can be more advantageous than waiting until war begins, when protected facilities may be harder to attack. Nato secretary general Mark Rutte warned at the end of 2025 that Russia could be ready to use military force against the alliance within roughly five years. German military leadership has likewise worked on the basis that Germany should be prepared for a possible major conflict with Russia by 2029 or earlier.
The immediate priority is to establish what caused each August explosion. The larger issue is whether Europe can expand and protect its ammunition production quickly enough to prevent isolated incidents, whatever their cause, from becoming a broader weakness in the alliance’s defence capacity.
Should European governments focus first on accelerating ammunition production or on securing existing defence sites against sabotage?
