← All Incident Reports
Incident report · TESSOC: Sabotage

Warsaw-Lublin: a line to Ukraine, cut

An explosive destroyed a section of the Warsaw-Lublin railway - a route carrying aid to Ukraine - with a second tampering site nearby. No one was hurt, and that appears deliberate: calibrated damage designed to disrupt and intimidate without triggering a NATO military response. The lesson is protecting critical transport infrastructure against low-signature, deniable sabotage.

↓  Download one-page brief (PDF)
Who
Actor: assessed by Poland as Russian intelligence services; two suspects identified as Ukrainian nationals who collaborated with Russian services and fled to Belarus. Casualties: none.
What
An improvised explosive device (IED) destroyed a rail track as a freight train passed; a second site had a metal brace fixed across the rails and overhead power wires knocked down.
Where
The Warsaw-Lublin line - site one near Mika (~100 km south-east of Warsaw), site two near Puławy - roughly 100 km from the Ukrainian border.
When
Night of 15-16 November 2025.
Why
To disrupt a route used to move aid and goods to Ukraine, and to intimidate - assessed as part of a Russian sabotage campaign on NATO's eastern flank.
How
An improvised explosive device (IED) was detonated as a freight train passed near Mika; the blast destroyed a section of track and damaged the freight wagon's undercarriage. Overhead power cables on the line were also brought down.
What happened
WARSAW → LUBLIN LINEWarsawLublin1Mika: IED, freight train2Puławy: brace + wires downAid route to Ukraine. Sites shown at their approximate position along the line.Schematic, not to scale
1

The line

The Warsaw-Lublin route carries civilian traffic and shipments toward Ukraine, about 100 km from the border - a logistics artery for the war effort.

2

~21:00, near Mika

An improvised explosive device (IED) detonates as a freight train passes, destroying a section of track and damaging the wagon's undercarriage. The passing train's crew does not notice at the time; the damage is reported the next morning when another train flags track irregularities.

3

A second site, Puławy

Further along the line, a metal brace is fixed across the tracks and several overhead power wires are brought down - a second, cruder attempt to derail or disrupt.

4

Discovery

A train driver reports track damage on 16 November; police and prosecutors treat both sites as deliberate sabotage aimed at causing a rail catastrophe.

5

Attribution and response

Poland identifies two Ukrainian-national suspects working with Russian intelligence who fled to Belarus, closes Russia's last consulate, deploys troops to guard infrastructure, and raises the alert level.

Impact
Human & physical
No casualties - assessed as deliberate calibration. Track, overhead power and a freight wagon damaged; disruption to a strategic line.
Operational
Interference with a route used to move aid and materiel to Ukraine - hitting the logistics of the war from inside a NATO state.
Reputational & political
An exploitable demonstration that critical transport can be attacked and the attacker slip away - and a deliberate probe of NATO's threshold for treating sabotage as an attack.
Adversary gain
Calibrated intimidation: enough damage to disrupt and signal reach, kept below the casualty level that might force a military response.
One campaign, many domains
2024-25

Europe-wide sabotage

A sustained pattern of Russian-linked arson, sabotage and surveillance across Europe, frequently using recruited proxies.

Sep 2025

Polish airspace

~19 Russian drones probe Polish airspace - the air domain of the same pressure.

15-16 Nov 2025

Rail sabotage

The Warsaw-Lublin attack described here.

Nov 2025

Diplomatic break

Poland closes Russia's last consulate and deploys troops to guard critical infrastructure.

In our assessment the low casualty count is a feature, not a mercy: intelligence services assess the campaign as calibrated to disrupt and intimidate while staying below the threshold that would trigger a NATO military response. Critical national infrastructure is the target set.

Assessment
1

Calibration is the tell

Damage was real but casualties were avoided. That points to a deliberate ceiling - disruption and signalling, not mass casualties - and to a professional hand behind disposable proxies.

2

Linear infrastructure cannot be fenced

Hundreds of kilometres of open track cannot be guarded end to end. Protection has to be risk-based - sensors and patrols on the critical segments, rapid inspection, and resilience to keep moving after a hit.

3

Detection and speed beat perimeter

The realistic defences are monitoring (CCTV, track sensors, drones), fast damage assessment and repair, and the intelligence work to attribute a pattern - not an impossible physical cordon.

The comparison worth making

Fencing the whole Warsaw-Lublin line is impossible - as impossible as barriering an entire event perimeter. The answer is the same discipline: identify the critical segments, sense and patrol those, and build in the resilience to detect, assess and recover fast. You protect what matters most, where an adversary would actually strike.

What should carry
  • Prioritise the critical segments - risk-assess the network and concentrate sensors, patrols and lighting where a strike would hurt most (junctions, bridges, aid corridors).
  • Instrument the line - CCTV, track-intrusion and vibration sensors, and periodic drone or foot inspection of high-risk stretches.
  • Build resilience - rapid damage-assessment and repair capability, and rerouting plans so a single hit does not stop the flow.
  • Guard the material and the method - control access to explosives and detonators, and work the proxy-recruitment and financial trails behind the attack.
  • Treat it as one campaign - integrate rail, air and cyber incidents into a single hybrid-threat picture, and pre-agree the political response.
Sources

Compiled from open-source reporting for professional security discussion. Figures and attributions may be revised as investigations and court proceedings continue. This is a protective-security lessons-learned assessment, not an operational account.