Germany’s attribution of an attempted drone attack at Leipzig/Halle Airport to Russia has brought the evidence behind Europe’s sabotage claims into focus, with criminal cases and research datasets measuring different things.
The German government announced its conclusion Sept. 1, calling it a political attribution based on the equipment and method used, police work and intelligence findings. It said the criminal investigation was continuing.
Research groups have recorded a rise in suspected activity, but their totals are not interchangeable. The Center for Strategic and International Studies (CSIS) counted three European attacks and plots in 2022, 12 in 2023 and 34 in 2024. Its dataset focuses on operations with actual or intended physical effects, and it sought at least three credible sources linking each case to the Russian state.
GLOBSEC and the International Centre for Counter-Terrorism identified 151 cases from February 2022 through February 2026. That tally covers a longer period and uses different selection criteria than the CSIS figures. Neither total represents a count of Russian attacks established in court.
Saxony prosecutors said an airport employee found an explosive device attached to a drone in a secured freight area during the night of Aug. 4–5. Police removed the detonator. Prosecutors also said a possible second flying object struck a cargo aircraft, leaving minor damage.
Other incidents have produced convictions or guilty pleas. Britain’s Crown Prosecution Service (CPS) said Dylan Earl and Jake Reeves pleaded guilty to offenses tied to a March 2024 warehouse fire in east London. The agency said they organized the arson on behalf of the Wagner Group. The warehouse held humanitarian aid and Starlink equipment destined for Ukraine, and damage and repairs cost about £1 million.
Lithuanian prosecutors reported that a court convicted a person of setting fire to a Vilnius IKEA store in May 2024. They said the offender acted for the benefit of Russian military and security structures; that state link is the prosecutors’ account.
The scope of the claims also varies. A May 2, 2024, NATO statement grouped sabotage with cyber and electronic interference and disinformation under Russian hybrid activity. The International Institute for Strategic Studies (IISS) includes suspected and confirmed operations in its dataset and assigns confidence tiers to its incidents.
Investigations can establish causes outside sabotage. The United Kingdom’s National Energy System Operator (NESO) found that moisture in a transformer bushing most likely caused the March 2025 North Hyde substation fire that disrupted Heathrow Airport. Germany’s criminal inquiry into the Leipzig attempt remains open, with no date announced for its next decision.
