“Reports of an increasing number of sabotage incidents and attempted sabotage targeting [European] defense-related organisations underline the need for vigilance across the sector,” a spokesperson from the Aerospace, Security & Defense Industries Association (ASD) of Europe told Breaking Defense.
ASD calls for closer coordination among industry, governments and security authorities
ASD, which says it represents over 4,000 companies in 22 countries, urged companies, governments and security agencies to “work closely together” to anticipate and counter sabotage threats. The association’s spokesperson told Breaking Defense it is “more important than ever that industry, governments and security authorities work closely together to monitor evolving threats, share information and take appropriate measures to protect facilities and maintain secure, resilient operations.”
Recent incidents: Poland, Germany, Denmark, Bulgaria and Estonia
European defense-linked sites have suffered a string of suspicious fires and explosions in recent weeks and months. On Aug. 31, a major fire broke out at WB Electronics, a large Polish private arms company that produces drones used by the Ukrainian military; Polish Prime Minister Donald Tusk said there was “no doubt” the incident was deliberate and suggested it was likely carried out on behalf of Russia, calling it “a continuation of Russia’s escalatory actions throughout the region.”
German officials publicly blamed Moscow for an alleged failed sabotage plot at Leipzig/Halle Airport involving a drone carrying explosives found in the vicinity of a Ukrainian cargo aircraft. Denmark’s head of counter-intelligence, Emil Græsholm, warned on Sept. 2 that “The Russians are actively preparing acts of sabotage targeting the defense industry in Denmark,” and said defense firms tied to military support for Ukraine were especially at risk.
On Aug. 10, a truck fire at Bulgarian private arms producer EMCO’s storage facility led to explosions that destroyed the company’s warehouse; the Bulgarian prosecutor’s office said the investigation remains ongoing. EMCO’s spokesperson noted similar incidents in 2011, 2022 and 2023. Days later, overnight on Aug. 14–15, a fire at a building housing Estonia-based Milrem Robotics — a primary maker of uncrewed ground vehicles bound for Ukraine — was called an arson attack by Estonian Prime Minister Kristen Michal, who said “The suspects have been identified” and that one line of investigation includes “the involvement of Russia.”
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCompanies report stepped-up security and cautious public messaging
Some firms described ongoing reassessments of site security. A spokesperson for Germany’s Rheinmetall said that since the start of Russia’s invasion of Ukraine in 2022, federal and state security authorities have observed an increasingly “aggressive stance” towards NATO countries; the company said it has reassessed security at its sites “on a risk-based basis and adjusted measures where necessary” and that its security strategy allows it “to respond swiftly to changing threat scenarios.”
Milrem’s director of communications, Gert Hankewitz, told Breaking Defense that the company’s review and development of security measures is a “continuous process” and that he could not comment on specifics for operational security reasons, but that Milrem had not seen an impact on day-to-day operations or existing customer orders. EMCO’s spokesperson said the latest investigation “will not be resolved within the next ten years” and added, “Unless all EU/NATO countries unite, this phenomenon will only intensify.” Breaking Defense reported that many major firms either did not respond to requests for comment or declined to discuss their posture because of the sensitivity of the topic.
Intelligence, attribution and denials
Attribution in these cases varies across agencies and public statements. An August 2025 IISS study recorded dozens of questionable incidents across Europe since 2018 and assessed Russia’s culpability in individual incidents as ranging from “realistically possible” to “almost certain.” German officials pointed to Moscow in the Leipzig/Halle case; Denmark’s counter-intelligence chief issued a direct warning about Russian preparations; and Poland’s prime minister cast the WB Electronics blaze as deliberate and likely linked to Russia.
Where claims of Russian involvement have been made, the Kremlin has routinely denied responsibility; it called the recent German allegation a “fabricated provocation.” Separately, CNN reported in July 2024, citing U.S. intelligence, that Rheinmetall CEO Armin Papperger had been targeted by the Russian government; Russia called that report a “fake story.”
What defense firms, governments, and Ukrainian suppliers are likely to do next
- Defense firms and procurement leaders: Firms already report reassessing security “on a risk-based basis” and adjusting measures where necessary; several companies say reviews are continuous and that operational orders remain intact even as security postures change.
- Governments and security agencies: National security services in Denmark, Germany and Poland have publicly issued warnings or allegations and are conducting investigations (for example, the Bulgarian prosecutor’s ongoing probe into the EMCO warehouse destruction), indicating sustained intelligence and law-enforcement activity across multiple countries.
- Ukrainian suppliers and allied manufacturers: Ukrainian firm leaders such as Vladyslav Belbas of Ukraine Armor voiced concerns that sabotage operations could presage broader confrontation and called on NATO to clear out what he described as “a lot of Russian spies,” reflecting pressure on allied suppliers to press for coordinated stateside responses.
The record in recent weeks is emphatic: European industry representatives are urging vigilance, national officials are publicly assigning blame in some cases, company spokespeople report stepped-up security, and investigators continue to examine causes. The question the facts lay bare is whether the cross-border mix of public warnings, private security adjustments and multi-year investigations will coalesce into the unified response some company spokespeople say is needed — or whether the pattern of fires, explosions and alleged sabotage will continue to ripple through Europe’s defense supply chain.
