The Poland Starlink sabotage investigation began after a fire broke out Wednesday evening at a ground-based Starlink satellite communications station in central Poland. Deputy Prime Minister Krzysztof Gawkowski said the fire engulfed the site's power station and generator and was deliberately intended to disable the facility, potentially cutting internet access to institutions that included the Ukrainian military.
The most important immediate fact is also the narrowest one: the systems were operational again by Thursday, Gawkowski said. Poland has classified the incident as suspected sabotage, but it has not publicly identified a perpetrator. Gawkowski said responsibility had not been established and stopped short of accusing Russia directly, while arguing that the method was consistent with what he described as a new Russian doctrine of attack.
What Poland says happened at the Starlink station
According to Gawkowski's account, the fire was not confined to an incidental part of the site. It reached the power infrastructure and generator—the systems needed to keep communications equipment running when ordinary electrical supply fails. He said the design of the attack made the intended outcome clear: disable the station and disrupt internet access for the institutions relying on it.
That assessment is an official conclusion at the opening stage of an investigation, not a public presentation of forensic evidence. The cited reporting did not identify the station's exact location, explain how the fire was started, describe the security breach, name suspects or say whether anyone was injured. It also did not establish the duration or operational effect of any interruption. Those gaps matter because intent, method and attribution are separate questions.
Polish authorities can reasonably treat a deliberately set fire at strategic communications infrastructure as a national-security matter. They cannot, on the available public record, turn that finding into proof of who ordered or carried out the act. That distinction is central to responsible reporting on sabotage: a state may identify the character of an incident before it can identify the actor behind it.
Why “hybrid warfare” is the central warning
Gawkowski linked the episode to Prime Minister Donald Tusk's recent warnings about hybrid warfare. The phrase describes pressure below the threshold of conventional armed attack: sabotage, cyber operations, disinformation, coercion and covert action designed to create damage or uncertainty while making attribution difficult.
In this case, the label is an attributed Polish assessment. Reuters reported that Poland has remained on heightened alert for sabotage since Russia's full-scale invasion of Ukraine in 2022 and that Russia has repeatedly denied responsibility for such actions. Gawkowski said “many signs” suggested the fire aligned with Russia's doctrine, but he explicitly acknowledged that Russian responsibility had not been established.
That combination—high confidence that an act was deliberate, lower confidence about who directed it—is typical of the strategic problem hybrid operations create. Governments must protect infrastructure quickly, yet premature attribution can harden public assumptions before investigators have completed the evidentiary chain.
Why Starlink's role in Ukraine raises the stakes
Starlink has become an important layer of internet connectivity for Ukraine, including military communications, because a distributed satellite network can preserve links when terrestrial systems are damaged or overloaded. A ground station in Poland serving users across the region therefore sits at the intersection of civilian telecommunications, wartime resilience and NATO territory.
The incident does not mean Ukraine's communications were broadly cut. Gawkowski said the station was again operational, and the available reporting did not quantify any interruption. But the target choice, as Polish officials describe it, shows why supporting infrastructure outside Ukraine can become part of the same security contest as missiles, drones and electronic warfare inside the country.
The broader pressure is visible in the same day's Russian ballistic-missile strike on Kyiv. The physical attack and the Polish fire are different events, and no public evidence connects them operationally. Together, however, they illustrate why communications resilience is treated as part of wartime defense rather than an ordinary utility question.
Poland's security problem is wider than one fire
Poland is both a NATO member and a principal route for support moving toward Ukraine. That makes transport, energy and communications infrastructure strategically important—and potentially attractive to anyone seeking to raise the cost of assistance without openly attacking the alliance.
Warsaw's response will therefore be judged on two standards at once. It must show that critical sites can be restored and protected, while also preserving the evidentiary discipline required for credible attribution. The first standard is operational; the second is political and legal. Failing either can benefit the suspected saboteur: prolonged disruption creates direct harm, while unsupported accusation creates confusion and division.
The same distinction applies across other regional fronts. Signal Post News's report on Iranian advisers and the Houthi advance on Yemen's Red Sea coast separates reported external support from what investigators and independent reporting can verify. Different conflicts require different evidence; the common standard is to label claims by source and confidence.
Who benefits, who loses
Poland gains a limited resilience success. The station's restoration means the apparent objective of sustained disruption was not achieved. A rapid return to service also gives investigators a functioning system to secure while they examine the damaged power equipment and the route used to reach it.
Ukraine remains exposed to attacks on systems beyond its borders. Redundancy reduces the effect of losing any single node, but dependence on infrastructure spread across allied territory widens the physical area that must be protected. The people and institutions relying on Starlink lose even when an interruption is brief, because uncertainty about continuity can force contingency measures.
NATO governments face an attribution test. A conventional attack on allied territory presents one kind of decision. A covert fire with uncertain sponsorship presents another: how to harden defenses and coordinate investigations without overstating what is known. That is the political leverage hybrid tactics seek.
What investigators need to establish
The case will turn on evidence not yet public: the ignition point, accelerants or devices, access logs, surveillance footage, damage to fences or locks, communications between any suspects, and whether the target had been observed before the fire. Investigators will also need to determine whether the station's role was known to the attacker or whether the site was chosen for another reason.
Attribution would require a further chain linking any person who entered the site to an organizer, sponsor or state direction. Similar methods, timing or political benefit can guide an investigation, but none alone proves command responsibility. Poland's warning is therefore significant without being a final verdict.
What happens next
Three developments will show whether the episode remains a contained security case or becomes a wider diplomatic confrontation.
- Forensic findings. Polish authorities may release details supporting the sabotage assessment and clarifying how access was gained.
- Infrastructure measures. Poland and other European governments are likely to review physical security, backup power and redundancy at communications sites serving Ukraine.
- Attribution and response. If investigators identify a network or state sponsor, Warsaw will have to decide whether the evidence supports prosecution, diplomatic action, sanctions or consultation with allies.
Those decisions will unfold while wider negotiations over the war remain unsettled. The Trump–Zelenskyy UNGA meeting and energy-ceasefire discussion showed that diplomatic proposals and immediate security pressures are moving on parallel tracks rather than replacing one another.
The bottom line
Poland says the fire at a Starlink station was a deliberate attempt to interrupt a communications system serving the region and Ukraine. The station is back online, limiting the immediate damage. The harder question—who carried out the act and whether anyone directed it—remains open. Gawkowski's hybrid-warfare warning is therefore both a security judgment and a demand for caution: Europe must defend the networks supporting Ukraine, but attribution must follow evidence.
Sources
- Reuters, “Poland suspects fire at Starlink station was act of sabotage,” September 24, 2026
- Europe Says live report, “Poland investigates suspected sabotage after fire at Starlink station,” September 24, 2026
Reporting note: The sabotage assessment and description of the station's role are attributed to Deputy Prime Minister Krzysztof Gawkowski. Polish authorities had not publicly identified a suspect or established Russian responsibility in the reporting available at publication.