Arson at the Polish Starlink ground station that carries traffic to Ukraine

At about nine in the evening on Wednesday 23 September, firefighters were called to a ground station in Wola Krobowska, a village just south of Warsaw. The fire took the power supply: the transformer station, the distribution board and the generator. The facility belongs to Exatel, Poland's state telecoms operator, and it is one of the points where satellite links, Starlink among them, meet the terrestrial network on their way across the region and into Ukraine.

By Thursday morning the station was working again, and Poland's digital affairs minister was calling the fire an arson attack on critical infrastructure. Whether Russia ordered it is a separate question, and the same officials who used the word sabotage were careful not to answer it yet.

What burned, and what that building does

The owner called emergency services to report burning antennas and a damaged generator. Firefighters contained the fire and secured the site; police officers and officers of the ABW, Poland's internal security agency, arrived because the blaze looked deliberate from the start. The preliminary reading is that someone set fire to the electrical distribution panel, though an electrical fault has not been formally excluded. Service was restored by the following morning.

A satellite constellation does not reach the internet on its own. Ground stations are the hinge: they pull traffic down from the satellites and hand it to terrestrial fibre, and back the other way. According to the Polish defence outlet Defence24, this facility, together with one in Lithuania, serves the whole of Central and Eastern Europe, Ukraine included, where Starlink terminals have been a core part of military and civilian communications throughout the war. Burning a distribution board is cheap. Rebuilding a regional hinge point is not.

What officials said, and what they refused to say

Krzysztof Gawkowski, digital affairs minister and deputy prime minister, gave two interviews that morning and the difference between them is the story. On TVN he said: "We're dealing with an arson attack that was intended to impact critical telecommunications infrastructure that influences internet operation," adding that "the modus operandi in this case is clearly Russian" and that it is "another element of the hybrid warfare we are facing". He described the goal in general terms: "The Russians want to paralyse critical infrastructure, cut off water, gas and electricity, paralyse the internet. All these processes have one goal: to incite panic and stir up emotions."

Speaking to TVP the same minister said that for now "it is impossible to say" whether Russia was behind this particular fire. Jacek Dobrzyński, spokesman for the security services, put it plainly: "at this stage it is still too early to talk about the causes or motives of this fire," while confirming that "everything points to arson". Justice minister Waldemar Żurek said sabotage is being taken into account and nothing is ruled out. That gap between a recognised pattern and a proven case is worth keeping open, because it is exactly the gap that gets closed too early in a headline.

1. November 2025A railway line in Poland is blown up; the suspects flee to Belarus and are put on Interpol notices.
2. 30 August 2026A fire at JFG Composites in Lublin, a maker of aerospace components.
3. 1 September 2026A fire at WB Electronics, the EU's largest drone producer; prosecutors open a terrorism investigation.
4. 2 September 2026Prime Minister Tusk says there is "no doubt" that was deliberate arson.
5. 23 September 2026A Russian helicopter briefly enters Polish airspace; that evening the ground station burns.
6. 24 September 2026The station is back in service and ministers call the fire sabotage.

The pattern the numbers describe

A joint dataset from the International Centre for Counter-Terrorism and GLOBSEC counted 151 Russian-linked sabotage incidents in Europe between February 2022 and February 2026, with 172 identified perpetrators. Poland had 31 of them, 21% and more than any other country, and of the 41 cases added since the previous edition, 11 were Polish. The authors note the real figure is probably higher, because cases surface only after long investigations or once someone can be named.

The part that explains the method is the perpetrators. Roughly 95% of those 172 people were ordinary civilians with no formal tie to Russian intelligence, described by the researchers as disposable. Poland's ABW has said the model is shifting from one-off recruits found online to cells built on existing organised-crime structures, with an interest in former soldiers and police officers. That is why targets look random and cheap: a paid stranger with a can of petrol does not need to know what a distribution board does, only where it is.

Why the ground station is the soft spot

Satellite internet is the standard answer to a state shutting down the network: when the cables and the mobile masts are switched off, a dish on a roof still finds a satellite. But that answer has a physical dependency that users never see, and it sits in a field outside a village. The satellites are hard to reach. The building where their traffic lands is reachable by anyone with a ladder.

Europe's response to the dependency question has been to build its own constellation rather than to harden the ground segment, which we looked at when the EU signed off on IRIS², a network that is not a Starlink for citizens. The same lesson keeps arriving from the sea: cables and landing points are where an attack costs the least, as in the fibre link cut between Finland and Russia.

What this changes for an ordinary connection

Nothing a person installs on a phone helps here. A VPN protects traffic while it travels; it has no answer when the power supply of the building that carries it is on fire. Redundancy is the only useful reaction, and it is a decision made by operators and states rather than by users: more than one ground station per region, real backup power, and physical security at sites that were designed as ordinary industrial buildings.

For individuals the practical version is smaller. Keep a second connection that does not share the first one's infrastructure, usually mobile data alongside home broadband. Keep an offline-capable messenger installed for the case where connectivity is gone rather than filtered. And treat the loss of service as information: a national outage and a targeted one look identical from a kitchen table, and both are worth checking against a status page before assuming the router is the problem.