Starlink Arson Probe in Poland Raises Digital Infrastructure Risks

A suspected arson attack on a Starlink ground station near Warsaw is drawing attention to the vulnerability of digital infrastructure that supports communications, financial services and the wider technology economy.

German magazine Der Spiegel reported, citing sources in several countries, that the Turkish organized crime group Daltons may have been involved in the attack and may have acted on instructions from Russian intelligence services. The group has for years been linked to extortion, arms trafficking and contract killings, including crimes in Germany.

The incident adds to concerns that physical attacks on communications infrastructure can create risks extending well beyond telecommunications. Satellite connectivity can support payment acceptance, online banking and other digital services in locations where terrestrial networks are unavailable, unreliable or disrupted. Even a short outage can therefore expose the dependence of the digital economy on power supplies, generators and other physical components.

Suspects face possible extradition to Poland

Two Turkish citizens detained on October 12 in the German city of Nürtingen as part of the investigation were identified by Der Spiegel as 38-year-old Ümit E. and 34-year-old Müslüm T. Representatives of several security agencies told the magazine that the men either belong to the Daltons group or carried out assignments for its members.

The Higher Regional Court in Stuttgart is expected to decide soon whether the two men should be extradited to Poland.

Investigators are also examining whether the criminal organization may have operated on behalf of Russian intelligence. Der Spiegel noted that Beratcan Gökdemir, the alleged leader of the Daltons, was detained in Russia in 2024. Turkey requested his extradition, but Russian authorities did not hand him over to Ankara.

German intelligence services believe Moscow may have offered Gökdemir protection in anticipation of reciprocal services, according to Der Spiegel.

Gökdemir’s current whereabouts are unknown. No direct evidence of Russian involvement in the Starlink fire has been established so far.

Fire briefly disrupted the satellite facility

The Starlink ground station in the village of Wola Krobowska, about 50 kilometers from Warsaw, was damaged in an arson attack on September 23. The fire affected an electrical substation and a generator.

German tabloid Bild reported that the facility stopped operating briefly before returning to service. No injuries were reported.

Polish authorities described the incident immediately after the fire as an attempted act of sabotage. On September 23, Polish Deputy Prime Minister Krzysztof Gawkowski said that, while there was not yet direct proof tying Russia to the attack, many indications suggested that the incident was consistent with a new Russian doctrine for conducting attacks.

Two additional people, including a woman, were detained on October 13 during the investigation. Polish radio station RMF FM reported that an anti-terrorist operation was conducted in Berlin to arrest her. According to the preliminary version under consideration, the woman may have provided logistical assistance to the Turkish citizens and served as their driver.

Operational risk for finance and technology

The case illustrates how threats to digital services increasingly cross the boundary between cyber risk and physical security. An attack does not need to penetrate software or banking systems directly to affect connectivity-dependent operations. Damage to electricity infrastructure, backup generation or communications nodes can interrupt the networks on which payment terminals, mobile applications and cloud-based business systems rely.

For banks, payment companies, cryptocurrency platforms and other financial technology providers, the incident reinforces the importance of redundant communications and power arrangements. It also highlights the need to account for coordinated physical attacks in operational-resilience planning, alongside malware, distributed denial-of-service attacks and data breaches.

The suspected use of an organized crime network, if confirmed by investigators, would also demonstrate the difficulty of attributing attacks conducted through intermediaries. That uncertainty can complicate risk assessments for technology companies and investors, including those evaluating satellite communications providers and other businesses operating critical digital infrastructure.

Starlink’s quick return to service indicates that the September incident caused only a temporary disruption. The broader investigation, however, will be watched for evidence about who commissioned the attack and whether it formed part of a wider campaign against European communications assets. The court’s extradition decision and the findings concerning the other detainees could provide the next important developments in a case linking organized crime, national security and the resilience of the digital economy.