Poland prepares for possible Russian attacks designed to turn society against Ukraine

Poland’s security services are preparing for possible Russian sabotage operations designed to deepen the growing political and historical dispute between Warsaw and Kyiv, according to the minister overseeing Polish intelligence agencies.

Tomasz Siemoniak warned on Wednesday, July 1, 2026, that Russia could attempt attacks against Ukrainians, aid organisations, military facilities or other sites linked to Polish support for Ukraine. He stressed that authorities had not identified a specific imminent plot, but said Russian services were showing interest in locations capable of inflaming public hostility if attacked.

The warning follows a sharp deterioration in Polish-Ukrainian relations after President Karol Nawrocki revoked Ukrainian President Volodymyr Zelenskyy’s Order of the White Eagle, Poland’s highest state distinction. The decision was prompted by Ukraine’s naming of a military unit after the Ukrainian Insurgent Army, whose members are blamed in Poland for massacres committed against Polish civilians during the Second World War.

Polish authorities believe Russia is using online influence operations to amplify the dispute and could employ sabotage or a staged attack to convert historical anger into a wider breakdown of public support for Ukraine. Moscow regularly rejects Western accusations that it organises sabotage, cyberattacks or political interference in European countries.

What did Tomasz Siemoniak say about the threat of Russian sabotage in Poland?

Tomasz Siemoniak said Russian intelligence services had long sought to produce the greatest possible tension between Polish and Ukrainian society. He described recent online activity as an intensified information campaign involving trolls, automated accounts and other efforts to magnify existing disagreements.

The immediate concern is not necessarily a large conventional attack. Polish services are preparing for operations that could be carried out through recruited intermediaries, arson, vandalism, explosive devices, cyberattacks or attacks staged to obscure the identity of those responsible.

Siemoniak said individuals suspected of acting on instructions from Russian services had shown interest in facilities important to Polish-Ukrainian cooperation. These included military infrastructure, critical infrastructure, sites supporting weapons or logistics for Ukraine, humanitarian organisations and other locations associated with the Ukrainian community.

He also said an attack targeting Ukrainians inside Poland was an entirely plausible scenario. Such an operation could be intended to generate anger against refugees, encourage retaliatory violence or create claims that Polish authorities were unable or unwilling to protect Ukrainians.

The minister did not announce the discovery of a specific bomb, target list or operational cell preparing an immediate attack. His warning was framed as a risk assessment based on intelligence activity, previous sabotage cases and Russia’s ability to exploit politically sensitive moments.

That distinction is important. Poland is warning that the conditions for a provocation exist, not claiming that an identified attack is certain to occur on a particular date.

Why has the dispute over the Ukrainian Insurgent Army created an opening for Moscow?

The current crisis centres on fundamentally different historical memories of the Ukrainian Insurgent Army, commonly known as the UPA.

Many Ukrainians remember the movement primarily for its fight against Soviet control and its pursuit of an independent Ukrainian state. In Poland, the organisation is associated with the killing of Polish civilians in Volhynia and Eastern Galicia during the Second World War.

President Volodymyr Zelenskyy approved an honorary title referring to the “Heroes of the UPA” for a Ukrainian military unit. Karol Nawrocki responded on June 19 by revoking the Order of the White Eagle awarded to Zelenskyy in 2023.

Nawrocki said the decision was not directed against the Ukrainian people and did not change Poland’s assessment that Russian aggression threatens Polish and European security. Ukrainian Foreign Minister Andrii Sybiha nevertheless described the revocation as a strategic error, while senior Ukrainian figures returned or renounced Polish decorations in solidarity with Zelenskyy.

The dispute gives Russian influence operations authentic political material to exploit. Disinformation campaigns are more effective when they amplify real grievances rather than attempting to create entirely fictional disagreements.

Russian-linked accounts can promote claims that Ukraine is ungrateful for Polish support, that Poland intends to dictate Ukrainian historical memory or that continued assistance to Kyiv comes at the expense of Polish citizens. Different narratives can be directed at Polish and Ukrainian audiences while serving the same objective of weakening bilateral trust.

Why would an attack against Ukrainians in Poland be especially destabilising?

Poland became one of Ukraine’s most important military, logistical and humanitarian partners after Russia launched its full-scale invasion in February 2022. The country also accepted a large Ukrainian refugee population and became a central transit route for Western assistance.

An attack against Ukrainians could therefore have consequences extending beyond the immediate victims. It could increase fear within refugee communities, trigger protests and produce pressure for restrictions on Ukrainian organisations or public events.

A carefully designed operation could also exploit uncertainty over responsibility. Russian services have previously been accused of recruiting individuals from Ukraine, Russia and other countries to conduct sabotage in Europe, sometimes using people motivated primarily by money rather than ideology.

The nationality of an arrested suspect could then be used to obscure the commissioning network. A Ukrainian recruited by Russian intelligence could be presented online as evidence of Ukrainian hostility towards Poland, even when Polish investigators believed the operation had been ordered from Russia.

This approach allows the organising state to create both physical damage and political confusion. The attack becomes the first stage, while manipulation of public interpretation becomes the second.

Humanitarian groups are particularly vulnerable to this strategy. An arson attack or explosive device at a Ukrainian aid organisation could harm civilians while reinforcing narratives that refugee support has brought insecurity into Polish communities.

How has Poland’s experience with alleged Russian sabotage changed since 2022?

Poland says it has already experienced a sustained campaign involving espionage, arson, cyberattacks and attempts to damage infrastructure supporting Ukraine.

Polish prosecutors have charged suspects over alleged sabotage commissioned by foreign intelligence services. Previous investigations have involved plans targeting railway lines, courier networks, industrial facilities and locations connected with the movement of military and civilian supplies.

In November 2025, Poland attributed sabotage on the Warsaw-Lublin railway route towards the Ukrainian border to people allegedly working for Russian intelligence. The incident led Warsaw to strengthen infrastructure protection, deploy additional personnel and close Russia’s remaining consular facility in Poland.

Polish authorities have also blamed Russian state-linked hackers for destructive cyberattacks against renewable energy facilities, a manufacturing company and a heating plant. Russia has denied responsibility for malicious activity attributed to it by Poland and other Western governments.

The Internal Security Agency has warned that the threat may be evolving from loosely organised, low-cost recruits contacted online towards more professional sabotage cells involving people with military, law-enforcement, criminal or intelligence experience.

Professional teams would be more capable of conducting surveillance, handling explosives, maintaining operational security and selecting targets that create disproportionate political consequences.

How could Russia combine online manipulation with physical attacks inside Poland?

Hybrid operations are designed to combine several forms of pressure while remaining below the threshold of conventional war.

An online campaign can identify existing divisions, spread emotionally charged claims and prepare audiences to interpret a future incident in a particular way. A physical operation can then provide the event around which those narratives are organised.

For example, an attack against a Ukrainian centre could be followed by coordinated posts blaming Polish nationalists, Ukrainian extremists or government negligence. Different explanations could circulate simultaneously, increasing distrust even among people who reject the first version they encounter.

Bots and coordinated accounts can make fringe claims appear widely accepted by repeating them across social platforms. Altered images, false documents and fabricated witness accounts can further complicate the period before police establish reliable facts.

Siemoniak said Russian information warfare against Poland had intensified in recent weeks as the historical dispute with Ukraine deepened. Polish security officials believe Moscow’s objective is to transform a diplomatic disagreement into a broader social confrontation.

The strategy does not require every person sharing a hostile message to be controlled by Russia. State-linked actors can inject narratives that are then repeated voluntarily by citizens, activists and political figures who already hold strong views about refugees, historical memory or aid to Ukraine.

Could sabotage against Poland trigger a direct NATO confrontation with Russia?

A proven attack ordered by Russia against a NATO member would raise serious alliance questions, but it would not automatically produce a military response.

NATO’s Article 5 treats an armed attack against one member as an attack against all. Hybrid actions such as cyberattacks, sabotage or covert violence are assessed according to their scale, effects, attribution and the political decisions of member governments.

A small arson attack or failed sabotage plot would more likely produce arrests, sanctions, diplomatic expulsions and stronger security measures than collective military action.

A mass-casualty attack on critical infrastructure could create a substantially more dangerous situation, particularly if investigators established direct involvement by Russian state institutions.

Siemoniak said Western intelligence agencies were concerned about possible hybrid or even kinetic actions against Poland and the Baltic states. He did not say that an attack had been authorised or that intelligence agencies knew its intended timing or target.

Russia benefits from ambiguity because uncertain attribution can delay a coordinated response. European governments must investigate carefully while also avoiding a situation in which the demand for perfect evidence prevents them from reacting to a sustained pattern of hostile activity.

What does the warning mean for Poland’s military and humanitarian support for Ukraine?

Poland is unlikely to end strategic support for Ukraine because of the historical dispute. Nawrocki stated explicitly that revoking Zelenskyy’s decoration did not change Poland’s view of Russia as a security threat.

However, political support for Ukraine has become more complicated. Disputes over agricultural imports, refugee costs and wartime history have reduced the consensus that existed during the early stages of Russia’s invasion.

A sabotage campaign would seek to accelerate that change. Attacks on logistics hubs could physically disrupt assistance, while attacks on civilians or aid organisations could weaken public willingness to continue supporting Ukrainian refugees.

The danger is that legitimate political debate becomes inseparable from security suspicion. Polish citizens must remain free to criticise Ukrainian policy or demand historical accountability without automatically being labelled as participants in Russian influence operations.

At the same time, authorities must identify when authentic grievances are being manipulated through coordinated foreign activity. The challenge is to protect democratic debate while preventing hostile intelligence services from turning that debate into a security vulnerability.

Prime Minister Donald Tusk has urged both Poland and Ukraine to reduce tensions, arguing that their strategic interests remain aligned despite disagreements over historical memory.

Why are the Baltic states also concerned about Russian provocations and sabotage?

Estonia, Latvia and Lithuania share many of Poland’s security concerns. They border Russia or Belarus, support Ukraine and host infrastructure important to NATO’s eastern defence.

The region has experienced cyberattacks, navigation interference, suspicious damage to infrastructure and alleged sabotage plots attributed by Western authorities to Russian actors.

Lithuania has accused Russian military intelligence of organising attempted arson attacks against a company supplying equipment to Ukraine. Investigators said the wider network was also connected to targets in Poland, Romania and the Czech Republic.

The Baltic states are particularly concerned that Moscow could use a limited operation to test political unity within NATO without launching a conventional invasion.

A provocation could involve a drone crossing, damage to a subsea cable, an attack by covert operatives or an incident presented falsely as aggression by a NATO country. The intended result could be confusion over whether the alliance was facing an accident, criminal act, independent extremist or state-directed attack.

The European Union has repeatedly condemned Russian hybrid activity, including sabotage, cyberattacks, interference and disruption of critical infrastructure. It has responded through sanctions, intelligence cooperation and measures intended to improve the resilience of border regions and essential services.

What must Poland do to prevent a provocation from achieving its political objective?

The first requirement is stronger protection for sites identified as possible targets. These include railway routes, military logistics facilities, energy systems, Ukrainian organisations and public locations serving refugees.

Security agencies also need rapid communication procedures that can provide verified information after an incident. A prolonged information vacuum allows false accounts to spread before investigators release basic facts.

Polish and Ukrainian authorities must maintain direct contact even during political disputes. A sabotage operation becomes more effective when governments are already reluctant to share intelligence or coordinate public statements.

Community organisations can help identify suspicious surveillance, threats and attempts to recruit vulnerable individuals. Previous European cases indicate that foreign services may approach people online with offers of money for apparently minor tasks before gradually assigning more serious activities.

Poland must also avoid allowing security concerns to produce collective suspicion against Ukrainians, Russians or other migrant groups. Hostile intelligence services can recruit across nationalities, and the identity of the operative does not necessarily reveal the identity of the state commissioning the crime.

The most successful response would deny Russia both objectives: preventing the physical attack where possible and preventing any incident that does occur from destroying Polish-Ukrainian cooperation.

What are the key takeaways from Poland’s warning over possible Russian sabotage?

• Polish security services are preparing for possible Russian sabotage operations intended to worsen tensions between Polish and Ukrainian society, although authorities have not announced the discovery of a specific imminent attack.
• Tomasz Siemoniak said suspected Russian-linked actors had shown interest in military facilities, critical infrastructure, humanitarian organisations and other locations important to Polish-Ukrainian cooperation and support for Kyiv.
• Poland considers an attack targeting Ukrainians inside the country plausible because it could generate fear, provoke retaliatory hostility and weaken public support for refugees and continued assistance to Ukraine.
• The warning follows Karol Nawrocki’s revocation of Volodymyr Zelenskyy’s Order of the White Eagle over Ukraine’s decision to honour a military unit with the name “Heroes of the UPA.”
• Russia could exploit genuine historical anger over the Volhynia massacres through trolls, bots, misleading narratives and coordinated accounts designed to turn a diplomatic dispute into a wider social confrontation.
• Poland has previously accused Russian intelligence of commissioning railway sabotage, cyberattacks, arson plots and operations involving explosive parcels, while Moscow has repeatedly denied organising hostile activity in Europe.
• Polish officials warn that Russia may be shifting from inexpensive online recruits towards more professional sabotage cells capable of surveillance, explosives handling and attacks with greater potential to cause casualties.
• Preventing escalation will require physical protection for vulnerable sites, rapid public communication, Polish-Ukrainian intelligence cooperation and safeguards against collective suspicion towards refugees or particular national communities.