Explosion on a railway line in Poland: Warsaw accuses Russia of sabotage attack
Early in the morning of 16 November 2025, the driver of a train travelling between Warsaw and Lublin noticed an irregularity on the railway line. He stopped the train, notified the authorities, and began inspecting the section. Technical teams subsequently discovered significant damage to the tracks near the village of Mika, approximately 100 kilometres from the Polish capital.
According to initial findings, an explosive device had been placed directly on the track. The train did not derail, and no passengers were injured. A second damaged section was found further along the same line, supporting the hypothesis of a coordinated attack.
The following day, 17 November 2025, Prime Minister Donald Tusk publicly announced that “an explosion of an explosive device had destroyed the railway track” (ABC News). He described the incident as “unprecedented sabotage” targeting Poland’s security — a statement echoed by Reuters. The investigation has been assigned to the public prosecutor’s office, the Internal Security Agency (ABW), and the police. Investigators are working to determine how the explosive device was placed and whether additional devices were installed elsewhere on the line.
Warsaw strongly emphasises the political nature of the attack. The Warsaw–Lublin line is not ordinary infrastructure: it is a major route for transporting aid — particularly military aid — to Ukraine. This rail corridor connects the Polish capital with entry points in the east of the country, through which a significant portion of supplies destined for Kyiv pass. “This route is crucial for aid deliveries to Ukraine,” Donald Tusk stressed. An attack on this link therefore indirectly disrupts the logistical flows supporting Ukraine’s war effort. Polish authorities say up to 115 trains use this route daily, including those carrying humanitarian and military aid, making it a key element of NATO’s support for Ukraine.
Following the explosion, Defence Minister Władysław Kosiniak-Kamysz deployed military units to inspect approximately 120 kilometres of track all the way to the Ukrainian border. The goal is to confirm whether additional explosives are present and to secure a route regarded as highly sensitive since the start of the war. Rail traffic was not completely halted; trains were able to continue on a parallel track. Nevertheless, the authorities acknowledge that the incident necessitates a permanent increase in security for lines used by logistics convoys.
Polish Interior Minister Marcin Kierwiński confirmed that two separate incidents had occurred — one confirmed act of sabotage and one highly probable. The prosecutor’s office has opened an investigation under the article concerning terrorist acts committed in the interest of a foreign intelligence service.
The sabotage took place at a time when Poland claims to be facing a sharp rise in hostile acts clearly linked to Russian intelligence activities. Since 2022, Warsaw has arrested dozens of individuals suspected of espionage or preparing attacks on critical infrastructure. Reuters reports that in October 2025 eight people were detained for sabotage plans coordinated from abroad. In this context, Donald Tusk declared: “We will catch the perpetrators, whoever they are.” The Prime Minister does not view the explosion as an isolated incident but as another manifestation of the “hybrid war” being waged against Poland.
On 17 November 2025, Polish Chief of the General Staff General Wiesław Kukuła stated that Russia is preparing for war with Poland and is escalating cyberattacks and sabotage on Polish territory. This “pre-war” environment includes not only physical attacks but also thousands of drone incursions and attempts to disrupt water supplies in major cities.
Russian sabotage in Poland and Czechia since 2022
This incident is not isolated but fits into a broader pattern of Russian hybrid operations across Europe, which have intensified since the full-scale invasion of Ukraine in February 2022.
According to a 2025 report by the International Institute for Strategic Studies (IISS), more than 50 Russia-linked sabotage incidents have occurred in Europe, ranging from vandalism and espionage to covert operations. In October 2025, Globsec and the International Centre for Counter-Terrorism estimated over 110 physical sabotage acts since 2022 — including 20 in Poland, 15 in France, and five in Czechia. These actions target critical infrastructure, Ukraine-aid logistics, and public morale while remaining below the threshold of open warfare. With hundreds of Russian agents expelled from Europe, Moscow now relies heavily on locally recruited proxies, organised crime networks, and platforms such as Telegram for coordination.
Key incidents in Poland
- Fire at Marywilska 44 shopping centre, Warsaw (May 2024) – not February: A massive blaze destroyed Poland’s largest Asian trading centre, causing billions of zlotys in damage. Polish authorities confirmed it was arson ordered by Russia’s GRU. Several intermediaries were arrested in Poland and Lithuania in 2025; the operation was directly ordered by a Russian intelligence officer. The incident contributed to the expulsion of Russian diplomats and the closure of the Russian consulate in Kraków.
- Arson attacks by a Colombian national (2024–2025): A Colombian citizen recruited via Telegram carried out arson attacks on military-related targets in Poland. In June 2025 he was sentenced in Czechia to eight years for setting fire to a Prague bus depot and planning further attacks. Poland’s ABW has charged him with terrorism; he faces possible life imprisonment.
- Cyberattacks on railways (2023–2025): In August 2023 the ABW uncovered a Russian hack into Poland’s railway signalling system aimed at disrupting arms deliveries to Ukraine.
- Arrests in October 2025: Eight individuals detained for planning sabotage in Poland and Romania under Russian direction. Since 2022 more than 55 people have been arrested in Poland for espionage or sabotage on Moscow’s behalf.
- Drone incursions (September 2025): Between 19 and 23 Russian drones entered Polish airspace, prompting a NATO response and the launch of the Baltic Sentry infrastructure-protection initiative.
- Other actions: Thousands of hoax bomb threats (2022–2023), cyberattacks on water-supply systems (August 2025), espionage at Rzeszów-Jasionka airport (2024).
Key incidents in Czechia
- Arson at Prague bus depot (2024): The same Colombian perpetrator (see above) set fire to a depot and planned attacks on shopping centres; sentenced to eight years in June 2025.
- Vrbětice ammunition depot explosions (2014, responsibility confirmed 2021/2024): Czech intelligence confirmed GRU Unit 29155 carried out the blasts that killed two Czech citizens.
- Mass hoax bomb threats (2022–2024): Thousands of threats targeting schools, airports, and public buildings, traced to pro-Russian actors.
- Cyberattacks on transport systems (2022–present): Repeated Russian attempts to disrupt railway signalling and ticketing systems (NÚKIB warnings).
- Voice of Europe propaganda network (2024): A Moscow-funded influence operation exposed and sanctioned by Czech authorities.
These incidents reveal a deliberate, coordinated strategy. European nations have responded with diplomatic expulsions, border reinforcements, and enhanced NATO cooperation. Although the IISS noted a decline in incidents during the first half of 2025, the risk — particularly to Ukraine-aid infrastructure — remains acute.
Poland and Czechia, as frontline NATO allies, must continue investing in hybrid-threat defences, from advanced cybersecurity to physical protection of critical rail lines. The November 2025 railway sabotage may mark the beginning of a new, more dangerous phase.
