Poland: Lublin and Skarzysko - two drone plants, two fires, one likely hostile entity
A masked man went over the perimeter fence at a WB Group plant at Skarzysko-Kamienna shortly after midnight on 31 August and set a storage area alight with a charge containing flammable materials. He appears to have been disturbed by a worker. Prosecutors opened the case under the article covering assistance to a foreign intelligence service, and as a terrorist offence. It is almost certain the fire was directed and enabled by a hostile state.
Thirty hours earlier a hall belonging to JFG Composites in Lublin had burned to the ground. Only one of the two is being investigated as sabotage. The Lublin fire is open on three hypotheses, including a technical fault, Poland's interior minister has said there are no grounds to state it was an attack, and officials have said there is no basis for joining the two. Both firms sit in the supply chain for uncrewed systems used by Polish and Ukrainian forces.
↓ Download one-page brief (PDF)Sunday afternoon, 30 August - a hall burns in Lublin
Fire takes hold in a two-storey building on Kasprowicza Street housing JFG Composites. About 60 firefighters attend after reports shortly before 15:00, and smoke is visible for several kilometres. The building is destroyed. Nobody is hurt and no evacuation is needed.
Shortly after midnight - a man goes over the fence at Skarzysko-Kamienna
Site cameras record a masked male crossing the perimeter of the WB Group plant. The plant is not in production at the time.
The fire is set, and the intruder is disturbed
A charge containing flammable materials is used to ignite a storage area. The intruder appears to have been startled by a worker and leaves; a backpack and a sweatshirt are recovered nearby. Five crews contain the fire in about two hours.
Monday - the Skarzysko case is opened as foreign-intelligence work
The National Prosecutor's Office opens an investigation under the article of the criminal code covering assistance to a foreign intelligence service acting against Poland, and simultaneously as a terrorist offence involving incendiary material. The ABW and the police are both engaged. Interior Minister Marcin Kierwinski says everything indicates an act of sabotage.
The Lublin case is opened under a different article entirely
Lublin prosecutors proceed under the article covering causing an event that endangers life or property on a large scale by fire. The regional prosecutor's spokesperson says there are no grounds at this preliminary stage to confirm or exclude any of the hypotheses under consideration.
Kierwinski separates the two in public
The same minister who called Skarzysko-Kamienna sabotage says there are no grounds to state unequivocally that the JFG fire was an act of sabotage. Officials say there is no current basis for linking the two fires.
More than one person at Skarzysko-Kamienna
Wirtualna Polska reports unofficially that investigators believe at least two people were involved, and that the figure on camera was the executor rather than the whole of it. A former ABW officer, Marek Swierczek, assesses that the perimeter and the security routine were reconnoitred beforehand.
A missile at Przewodow, and two men dead
A missile struck the village of Przewodow in Lublin province, a few kilometres from the Ukrainian border, killing two men. Western officials assessed it as a Ukrainian air-defence round that went astray. It was not an attack on Poland and it still killed two Poles, which is the point about this geography.
A drone at Osiny
A drone came down at Osiny in Lublin Voivodeship, reported by Scorpius under Armed Conflict as a cross-border incursion and airspace violation.
The mass incursion across eastern Poland
Nineteen or more drones entered Polish airspace in a single night and NATO aircraft engaged them, the first such engagement of the war. Reported by Scorpius; eastern Poland, including this corridor, was the area affected.
Explosive sabotage on the Warsaw to Lublin railway
The line carrying aid to Ukraine was blown up near Mika, with damage to overhead line near Pulawy. Poland attributed it to Russian intelligence acting through two Ukrainian nationals recruited for the job, and is seeking both men. Reported by Scorpius under Sabotage, with proxy recruitment among the methods.
A cross-border missile between Tarnawa-Kolonia and Tokary
A missile crossed into Lublin province during a Russian barrage on Ukraine. Reported by Scorpius under Armed Conflict.
A defence-industrial hall in Lublin itself
The JFG Composites fire. The cause is not established, and it is recorded here as an event in the corridor rather than as an attack on it.
This is not a list of Scorpius reports, and it should not be read as one. The province has taken a stray air-defence missile that killed two civilians, repeated drone incursions, explosive sabotage of the rail corridor carried out through recruited proxies, a cross-border missile, and now a fire at a defence supplier. The constant is the geography, not the method and not the actor. Przewodow was Ukrainian ordnance and the railway was Russian intelligence, and both landed in the same province for the same reason: it is the ground the war is routed across.
The two cases are being run under different articles, and that is the clearest signal available
Skarzysko-Kamienna is charged out as assistance to a foreign intelligence service and as a terrorist offence. Lublin proceeds under the general article for causing a large-scale danger by fire. Polish prosecutors had the option of the first article for Lublin and did not take it. Where a state has an intelligence-led framework available and declines to use it, that is evidence about the state of the case, and it should be read before the coincidence of dates is.
Almost certainly directed and enabled by a hostile state
Camera footage of a masked intruder, a charge containing flammable materials, a discarded backpack and a manhunt make it almost certain that the fire was set deliberately. Prosecutors opened the case under the article covering assistance to a foreign intelligence service, the ABW is engaged, and the target was a drone plant supplying Ukraine. Set against the established record in Poland - the 2024 arson that destroyed Warsaw's largest shopping centre, attributed by Poland to Russia, and the 2025 rail sabotage for which Poland is seeking two men said to have acted on Russian orders - it is almost certain that this attack was directed and enabled by a hostile state, and highly likely that the state is Russia. The recruited hand on the ground is the method, not the sponsor. Poland has not officially named Russia, Russia denies such activity, and no arrest has been made.
Lublin carries no band, because nothing is established
Three hypotheses are open and the building could not be entered. Attaching a probability to a deliberate cause here would be assigning a number to an absence of evidence. The honest position is that the cause is unknown and a fire expert has been appointed. If the finding comes back as arson the assessment changes; until then the fire belongs in the record as a loss, not as an attack.
The corridor is the finding, and it does not depend on the Lublin cause
Lublin province has been the subject of three earlier reports, under three different methods, in thirteen months. That pattern is established regardless of what caused this fire. It is highly likely that the province continues to feature, because its position on the route into Ukraine is what makes it useful and that does not change, and almost certain that the wider campaign against European defence manufacturers and Ukraine-support logistics continues in some form.
At least one more person, and probably a reconnaissance phase
A single figure appears on camera, and investigators are reported to believe at least two people were involved. A perimeter crossed at a chosen point, at a time when the plant was not in production, is consistent with prior observation. It is a realistic possibility that further Polish defence-industrial sites are under reconnaissance now, and that the next attempt is made against a site that has not yet reviewed its perimeter.
Set this beside the Warsaw to Lublin rail sabotage of November 2025, where the methods recorded include proxy recruitment and where Poland is seeking two men said to have acted on Russian orders. That case took months to move from an unexplained event to a named mechanism. This one is thirty-six hours old. The temptation to close the gap early is the risk, and the rail case is the reason to resist it: it was solved by investigation, not by inference from timing.
- Check the perimeter at the point nobody watches. The intruder chose a place to cross and a time when the plant was not running. Walk your own fence line at that hour and ask where you would go over it.
- Assume the site has been watched before it is touched. A former ABW officer assesses prior reconnaissance at Skarzysko-Kamienna. Staff should have a route for reporting someone loitering, photographing or asking questions, and it should not be the same inbox as a parking complaint.
- A worker interrupted this one. The intruder appears to have been disturbed by a member of staff. Night presence, lighting and the confidence to challenge are worth more here than another camera nobody is watching in real time.
- Know which chains run through your site. JFG feeds both a drone supply chain and a helicopter programme. A firm that only counts itself as a supplier to one customer will under-rate its own exposure and under-argue its case for protection.
- Do not brief two events as one campaign before the state does. Polish officials have said there is no basis to link these fires. A brief that joins them will have to be retracted if the Lublin cause comes back technical, and the retraction will cost more than the delay would have.
- Plan against the geography. Lublin province has now been the subject of four reports under four different methods. A site there should be planning for air incursion, rail disruption and ground intrusion together, not choosing whichever last made the news.
- https://www.aljazeera.com/news/2026/8/31/poland-opens-terror-probe-into-fire-at-drone-factory
- https://notesfrompoland.com/2026/08/31/poland-investigates-potential-foreign-intelligence-involvement-in-fire-at-drone-plant/
- https://brusselssignal.eu/2026/09/poland-suspects-sabotage-behind-fires-at-plants-linked-to-drone-production/
- https://defence24.pl/polityka-obronna/pozar-w-zakladach-zbrojeniowych-nowe-fakty-ze-sledztwa
- https://wiadomosci.wp.pl/nowe-ustalenia-ws-pozaru-w-skarzysku-sprawcow-bylo-co-najmniej-dwoch-7324681237915808a
- https://www.lublin112.pl/pozar-hali-jfg-composites-w-lublinie-sledczy-badaja-kilka-mozliwych-przyczyn/
- https://defence-blog.com/poland-sees-two-fires-at-defense-plants-in-24-hours/
- https://www.rferl.org/a/poland-suspects-russian-sabotage-in-railway-explosion/33594773.html
- https://www.pbs.org/newshour/world/poland-says-everything-indicates-russian-missile-briefly-crossed-countrys-airspace
Compiled from open-source reporting for professional security discussion. This is a protective-security lessons-learned assessment, not an operational account. No person has been arrested or charged in either case and no organisation has claimed responsibility; the individual recorded at Skarzysko-Kamienna is sought, not identified. Polish authorities have not officially named any state, and Russia denies conducting such activity. The cause of the Lublin fire has not been established and is under investigation as deliberate arson, technical fault or spontaneous ignition; it is included here because of the site and the corridor, not as an established attack. Polish officials have stated there is no current basis for linking the two fires. The report that at least two people were involved at Skarzysko-Kamienna is Wirtualna Polska's unofficial finding, not an official statement. Damage figures are as reported and may be revised. Some early reporting dated the Lublin fire to 31 August; 30 August 2026 was the Sunday to which those accounts refer.