Lithuanian authorities are treating a failed attempt to set fire to a company that stores SpaceX Starlink equipment as a deliberate act of sabotage linked to Russia, according to eualive, which dated the attempt to Sunday 18 October 2026. Prime Minister Mindaugas Sinkevičius disclosed the attempt; the sabotage assessment came from Vilmantas Vitkauskas, head of the National Crisis Management Centre, the government body that coordinates Lithuania’s response to incidents rather than investigating them. Vitkauskas told journalists that investigators were hunting the suspects and tied the case to earlier arson attacks on Starlink infrastructure in Poland and Bulgaria. Our earlier report covers the foiled arson at a Starlink equipment store.
“We understand that this was not an ordinary arson, but a sabotage act,” Vitkauskas said, as quoted by eualive. He described the three cases as part of a coordinated campaign of Russian attempts to disrupt Starlink operations, and said the target was Ukraine.
How we sourced this
This account rests on two secondary outlets, eualive and Greek City Times, which in turn quote national officials and the German magazine Der Spiegel. Starlink News has not seen charging documents, police statements or court filings from Lithuania, Poland or Bulgaria, and has not independently verified the claims attributed to officials in them. SpaceX is not quoted in either report and we found no public statement from the company on any of the three incidents. Attribution is given line by line below so readers can see which outlet carries which claim.
Key facts
- Lithuania: An unsuccessful arson attempt against a Lithuanian firm holding Starlink communications equipment, eualive said. Authorities had warned the company of possible threats in advance and security was strengthened, which prevented the attack from succeeding.
- Context on the day: eualive reported the episode occurred against the backdrop of a separate drone incident that violated Lithuanian airspace.
- Poland: A fire broke out on the evening of 23 September 2026 at a Starlink ground station in the village of Wola Krobowska, in Poland’s Masovian Voivodeship, roughly 50 km south of Warsaw, according to eualive.
- Polish charges: Prosecutors opened an investigation into sabotage, a terrorist-style offence and activity on behalf of a foreign intelligence service directed against Poland.
- Arrests: Two Turkish nationals were detained in Germany in mid-October on a European Arrest Warrant. Greek City Times reported the arrests took place in Nürtingen, Baden-Württemberg, following a Polish request for legal assistance.
- Bulgaria: Two masked individuals set fire to 11 of 17 antennas at a Starlink facility near Sofia, eualive reported.
Why it matters for satellite internet users
The pattern described by the three governments points at the parts of the satellite internet system that customers never see. A home or business dish talks to satellites, but the traffic reaches the wider internet through a small number of gateway earth stations — the kind of site that burned at Wola Krobowska and near Sofia. Damage at one of those sites therefore has consequences for users well beyond the village it sits in, a point Greek City Times made in noting that an attack on supporting infrastructure could have implications beyond the immediate location.
The Lithuanian case extends the exposure to the supply chain: the target there was a company storing user equipment, not a gateway, which puts Starlink availability for new European customers — dishes waiting to be shipped and installed — in the same risk picture as the network itself. On the reported evidence none of the three incidents produced a service outage, and the Bulgarian site kept six of its 17 antennas, but the practical consequence for operators and resellers in the region is the cost of hardening warehouses and unmanned ground sites that were never built to withstand deliberate attack. Readers following the war’s communications dimension can see why Starlink underpins Ukraine’s battlefield communications; eualive reported that Polish officials said the Wola Krobowska attack aimed to disrupt connectivity in Poland and other Central and Eastern European countries, including services used by Ukraine.
Poland’s investigation and the Daltons
Greek City Times, citing Der Spiegel, reported that Polish authorities are investigating a possible link between the fire and the Daltons, a Turkish organised crime group whose members have been linked to extortion, arms trafficking and contract killings in Turkey, Germany and other European countries. Multiple independent sources from several countries pointed to the group as a possible link, with members possibly acting on behalf of Russian intelligence services. The outlet stressed the claims have not been conclusively established.
Der Spiegel identified the two detained men as Ümit E., 38, and Müslüm T., 34, Greek City Times reported, with the Higher Regional Court of Stuttgart expected to decide on their extradition to Poland. Security sources reportedly believe they may be members of the Daltons or acted on instructions from people associated with it. The group’s alleged leader, Beratcan Gökdemir, was arrested in Russia in 2024 after Turkey sought his extradition, according to the same reporting; German security officials believe Russian authorities allowed him to remain in the country and may have offered him protection, and it is unclear whether he is still there. Separately, Starlink News has covered a fourth person detained in Germany over the Polish fire.
Surveillance and Polish counterintelligence
eualive reported that Polish counterintelligence (ABW) and police identified two Turkish nationals living in Germany as suspects, and that surveillance footage showed masked individuals entering the site, pouring flammable liquid and igniting control equipment.
The Bulgarian fire and a date discrepancy
The two outlets disagree on timing. Greek City Times said a Starlink station in Bulgaria caught fire in September; eualive placed an attack near Sofia on or around 9–10 October, linked to the Plana Earth Station area. The October dating is the better supported of the two: eualive names the site, the dates, the politician who publicised it and the prime minister who confirmed it, and was published after the Greek City Times piece, which gives only a bare month with no location or official attached. That does not rule out a second, earlier Bulgarian incident, and neither outlet has published a correction.
eualive reported that opposition MP Ivaylo Mirchev of the Democratic Bulgaria alliance first publicised the incident, describing antennas that provide a key link to SpaceX satellites used in the war in Ukraine. Prime Minister Rumen Radev confirmed the fire and said an intensive investigation was under way, security officials treated it as sabotage, and media reports indicated two young men holding German passports were detained, with investigators examining possible links to a broader network involving the Polish suspects. Greek City Times, writing earlier, said the available information did not establish whether the Bulgarian incident was connected to the Polish fire.
A wider shift towards organised crime, German officials say
Greek City Times reported that German authorities have warned Russia could be expanding its use of organised crime networks for sabotage in Europe. In May, Germany’s Federal Ministry of the Interior told the Greens that cooperation between Russian state actors and organised crime figures could be particularly suited to operations involving sabotage or targeted killings. Sinan Selen, president of Germany’s Federal Office for the Protection of the Constitution, warned on Monday of a growing threat potential without naming Russia, saying a broad range of attack methods and actors were being deployed in a coordinated way and that those responsible were prepared to accept fatalities.
Earlier suspected Russian operations in Germany and elsewhere had reportedly relied on intelligence officers and low-level agents, including petty criminals recruited for small assignments and limited payments, often without knowing who was behind the operation. If the Daltons’ involvement is established, the case could indicate a shift towards more established criminal organisations, the outlet said.
For Polish investigators, Greek City Times said, the open questions are whether the fire was part of a wider sabotage campaign, whether the Daltons were involved, and whether any operation was directed by Russian intelligence services.
Frequently Asked Questions
Did the attacks interrupt Starlink service in Poland, Lithuania or Bulgaria?
Neither eualive nor Greek City Times reported an outage or loss of service for Starlink customers in any of the three countries. The Lithuanian attempt failed before any equipment was damaged, and neither outlet said the Polish or Bulgarian sites stopped functioning. Polish officials described disruption as the attackers’ intent rather than the outcome, according to eualive.
Who decides whether the two men detained in Germany are sent to Poland?
The Higher Regional Court of Stuttgart, which Greek City Times reported is expected to rule on extradition. The pair were held on a European Arrest Warrant issued after a Polish request for legal assistance, meaning the German court reviews the warrant rather than the evidence of guilt; any trial would take place in Poland.
Has SpaceX commented on the attacks?
No statement from SpaceX or Starlink appears in either report, and we found no public comment from the company on the Lithuanian, Polish or Bulgarian incidents. Everything attributed to Starlink’s role in this story comes from government officials and the two outlets, not from the operator.
What would it take to confirm Russian direction of the attacks?
A court finding. Greek City Times reported that no publicly established evidence has yet confirmed the alleged chain of responsibility and that detention does not establish guilt. Polish prosecutors would have to prove the charge of acting on behalf of a foreign intelligence service, which is why the Stuttgart extradition ruling and any subsequent Polish proceedings are the points at which the suspicion is tested.
Follow Starlink News on Google. Make us a preferred source to see more of our reporting in Google search results.
