DOCUMENTING HYBRID WARFARE / — incidents / UPDATED LATEST: 
Sabotage Watch SABOTAGEWATCHHybrid Threat Monitor
Arson

Ukrainian man arrested in Wrocław for planning arson on paint factory

January 2024 · Wrocław, Poland
Satellite Imagery © Esri

What happened

In January 2024, officers from Poland's Internal Security Agency (ABW) detained a 51-year-old Ukrainian man, identified in line with Polish privacy rules as Serhyi S., in Wrocław. Prosecutors alleged he had been recruited online to carry out arson attacks in the city on behalf of Russian security services, as part of what authorities described as an international organised criminal group engaged in sabotage. According to the prosecution, his principal target was a paint and coatings factory in Wrocław, located close to a fuel storage facility belonging to the Polish state oil company Orlen.

Polish authorities said the man was offered roughly 4,000 dollars to set the plant alight, and that camera footage and mobile-phone data placed him near the site before he was stopped. He denied the charges but, according to reporting on the trial, admitted accepting an online order to commit arson, claiming he had intended only to defraud the person paying him rather than actually carry out the attack. The court rejected that account.

On 21 February 2025, a court in Wrocław convicted him of participating in an organised criminal group and preparing acts of sabotage on behalf of foreign intelligence, and sentenced him to eight years in prison. Reporting noted the ruling could still be appealed. Authorities said four other people had been charged in connection with the case, part of a wider series of sabotage and espionage arrests in Poland.

Assessment

The Russian-intelligence link is the position of Polish prosecutors and the ABW, framed within Warsaw's broader assessment of a Russian hybrid-warfare campaign against states supporting Ukraine; it reflects authorities' allegations and a court conviction rather than independently confirmed Russian state attribution. The case fits a documented pattern of low-cost operatives recruited online for modest sums to attempt arson against infrastructure. The choice of a paint factory adjacent to fuel storage suggests an intent to maximise damage, though the plot was disrupted before any fire was set.

This dossier summarises open-source reporting and is updated as the investigation develops. Read the original report via the source link.