Key actors — tap for context
Johann Wadephul
German Federal Minister for Foreign Affairs for the CDU.
Why here: He promised a "balanced and considered" response to the Leipzig attack and rejected excessive measures.
More info →
50Hertz
Transmission system operator for eastern Germany and Hamburg, one of the four German operators.
Why here: It owns the attacked Turnow-Preilack transformer station near the Jänschwalde power plant.
More info →
Jänschwalde
A lignite-fired power plant in Brandenburg, one of the largest in Germany.
Why here: The power plant itself was not the target of the attack, but the substation about ten kilometres away from it was.
More info →
WB Electronics
Flagship company of Poland's largest private arms group, it manufactures drone parts for the Polish and Ukrainian armies.
Why here: Its hall in Skarżysko-Kamienna burned in the night to Monday; the damage is at least fifteen million zlotys.
More info →
Marcin Kierwiński
Polish Minister of the Interior and Administration for Civic Coalition.
Why here: He said that everything points to an act of sabotage.
More info →
Friedrich Merz
German federal chancellor for the CDU, in office since 2025.
Why here: As late as Sunday he spoke of a "broad consensus" on the response, but did not name the culprit.
More info →The target was the substation, not the power plant
Pyrotechnicians were called on Tuesday to the Turnow-Preilack transformer station operated by 50Hertz. The facility lies about ten kilometres from the Jänschwalde lignite-fired power plant south of Berlin. The first callout came at 7:33 in the morning, and in the afternoon state interior minister Jan Redmann explained how the attack was supposed to work: the perpetrators used propellant to fire conductive material into a very high-voltage line in order to cause a short circuit, and they succeeded in two cases. A double-digit number of devices was found at the scene. Redmann also diverged from the police's initial statement: in his view there is no evidence of detonation; it was a short circuit so strong that it kicked up soil, and a 50Hertz employee saw a ball of fire. "This was not child's play," the minister said, adding that the perpetrators acted systematically. Die Zeit ↗ The consequence was limited but real: the network operator speaks of an arc flash and a temporary interruption of the line, and at the Jänschwalde power plant block B automatically shut down and is being restarted. The other three blocks kept running, so the electricity supply was not endangered. n-tv ↗ The investigation was taken over by the state criminal police office. Süddeutsche Zeitung ↗, Die Presse ↗The difference from the previous series lies in the choice of target. Fires and explosions that since August have hit an ammunition plant in Bulgaria, a factory near Rome, the hall of an Estonian combat-robot maker and a Polish drone producer were aimed at companies manufacturing for Ukraine. The substation in Brandenburg produces nothing - it is a network node. According to the findings so far, the attack was meant to cause a major power outage in the area around the power plant. That did not happen. ORF ↗ On Wednesday, that shift stopped being a one-off. Brandenburg's investigation was taken over by counterterrorism prosecutors, and Handelsblatt is already writing about a "series of attacks against energy supplies" that exposes security gaps in grid protection. The authorities are also examining whether the two cases are connected; according to FAZ, they show parallels. (Spiegel ↗, Handelsblatt ↗, FAZ ↗)
German security authorities are examining a possible far-left background in the Brandenburg substation case. According to Spiegel, the substation was supposed to be disabled by homemade flying devices in the style of New Year's Eve fireworks; their construction did not require specialist knowledge, but it was difficult. Welt cites confidential operational documents and describes copper wire and analogue clocks as parts of the charge. This is the first clue that does not fit the Russian narrative - but for now it is a line of inquiry, not a conclusion. (Spiegel ↗, Welt ↗)
The second attack came near Cologne, and the trail again points left, not east. In Bergheim in North Rhine-Westphalia, investigators found six launch devices in a field near the substation, and the principle was the same as in Brandenburg - a pyrotechnic charge was meant to fire copper conductors into the high-voltage line and trigger a short circuit. State interior minister Herbert Reul speaks of an initial suspicion of "anti-constitutional sabotage", the investigation is being carried out "in two directions", and Reul personally suspects far-left extremism. "It was intentional," he said. CDU MP Marc Henrichmann, meanwhile, warns against rushing to judgment. (Spiegel ↗, n-tv ↗, Tages-Anzeiger ↗, Tagesschau ↗, Tagesspiegel ↗)
The series at substations continues, and Minister Reul says the two sites "can hardly be a coincidence". The energy association is calling for a backup system for emergencies and easier monitoring of facilities, while the Greens are attacking Minister Dobrindt over gaps in infrastructure protection. (ZDF heute ↗, Spiegel ↗, Handelsblatt ↗)
Read also: In five days, three European arms factories burned. Intelligence services describe a pattern that Czech investigators have been looking into since March
Leipzig: a month of silence and then a name
A drone with explosives was found at Leipzig/Halle airport on the evening of August 4. According to camera footage, it flew toward one of Antonov's Ukrainian cargo aircraft, hit the wing and fell to the ground without exploding - according to investigators, the detonator failed. The airport is an important hub for arms deliveries to Ukraine. Since then, the case has expanded. About fifty grams of the explosive RDX were found at the scene, another unmanned aircraft was discovered west of the airport on August 14, and a DHL cargo plane collided during flight with an unknown small object that could have been a third drone. The authorities now believe that more than one drone was involved. ta3 ↗, BBC ↗ For almost a month, Berlin did not officially say who was behind the attack. It changed that on Tuesday evening: Interior Minister Alexander Dobrindt said that the police investigation, the pattern of the crime and intelligence findings together demonstrated Russian responsibility for the attempted attack. In his view, the drone configuration used, the components, the explosive and the ignition technique are known from other Russian hybrid operations and from the fighting in Ukraine; he attributed the actual execution to lower-level agents. According to Dobrindt, Germany is not at war, but is a "daily target of hybrid warfare". ZDF heute ↗, ta3 ↗ Handelsblatt ↗, Spiegel ↗The government attached five steps to the accusation. The Russian consulate general in Bonn is to close by September 18, the contract with the Russian House in Berlin will be terminated, entry checks for Russian citizens will be tightened, pressure on the Russian shadow fleet will increase, and Germany will push for sanctions against other responsible individuals within the European Union. Russian ambassador Sergey Nechayev was summoned by the Foreign Ministry that same evening. Spiegel ↗, ZDF heute ↗ Foreign Minister Johann Wadephul promised a "balanced and considered" response and added that there would be no exaggerated reactions from the German side, only reactions to being attacked. Moscow denies involvement and promises retaliation: spokesperson for the Russian Foreign Ministry Maria Zakharova announced a "mirror" response and accused Germany of sponsoring terrorism, while the Defence Ministry announced a response to the "anti-Russian decision". European Commission President Ursula von der Leyen and NATO Secretary General Mark Rutte, by contrast, expressed solidarity with Germany, and Rutte welcomed the announced measures. Spiegel ↗, ta3 ↗ Co-chair of the German Greens Franziska Brantner says that if Russian involvement is confirmed, it is state terrorism. ZDF heute ↗, Censor.NET ↗
On Wednesday came what had been missing in the Leipzig case for a month: names behind the act. According to German media, investigators identified two suspects based on DNA traces. One has a Russian passport, the other a Latvian one - a Russian with a Latvian document who came from Belarus; the Federal Criminal Police Office lists them as people with ties to Russian intelligence services. Baltic and Finnish media are also tracking their own trail: the second suspect appears in the records of Finnish authorities. (Welt ↗, n-tv ↗, Tagesschau ↗, Handelsblatt ↗, LSM ↗, Diena ↗, Äripäev ↗, Helsingin Sanomat ↗, Ilta-Sanomat ↗)
The Leipzig trail also leads to Serbia and Poland. Croatian media published new details of the investigation: in addition to the Belarusian and Latvian lines, German investigators are also tracking the suspects' movement through those two countries. These are media-reported findings, not the prosecutor's official position. (Index.hr ↗, 24sata ↗)
The Belarusian suspect entered Schengen with an Italian visa issued in Minsk. Bild reported the information, and Italian media unpacked it during the day; Foreign Minister Antonio Tajani promised to review the circumstances under which the visa was issued. Italian security sources later told ANSA that the suspect never transited Italy and that checks so far have come back negative. ANSA ↗ That same day Tajani warned that he did not rule out Russian attempts to influence Italian elections - Matteo Salvini replied that he was worried about "anti-Russian anxiety". Meanwhile, Germany is pressing the European Union for visa restrictions for Russian tourists, arguing that "the number is too high". (ANSA ↗, Open ↗, ANSA ↗, AGI ↗, Tagesspiegel ↗)
Italian visa practice got a number: Rome rejected two hundred out of fifty thousand applications. Il Sole 24 Ore set that ratio alongside the visa issued in Minsk - which comes out at roughly four per thousand. In that context, Tajani's promised review looks different: this was not the failure of a single office, but the normal outcome of a system that rejects almost nothing. (Il Sole 24 Ore ↗)
The European Union described the incident as "state-sponsored terrorism". That was the phrase used by foreign policy chief Kaja Kallas, the Union summoned the Russian ambassador and is preparing a sanctions package. Commission President Ursula von der Leyen said military-grade material was used in the attack and added: "We will not tolerate this, intimidation will not work." NATO Secretary General Mark Rutte called Russian behaviour increasingly reckless. (El País ↗, La Vanguardia ↗, LRT ↗, Het Laatste Nieuws ↗, Censor.NET ↗)
Retaliation is shifting to visas, and more ambassadors are being summoned. Germany wants visa rules for Russians tightened further, and the European Union is preparing stricter tourist visas on the grounds that "they are used for sabotage operations". After Leipzig, Austria, Ireland and Romania also summoned the Russian ambassador. (Helsingin Sanomat ↗, VRT NWS ↗, Kurier ↗, The Irish Times ↗, Adevărul ↗)
Pressure is also growing in Berlin that the response is too weak. MP Roderich Kiesewetter called it inadequate, is calling for consultations in NATO and expects "further Russian terror". Il Manifesto points out that although the Alliance recognises hybrid warfare as real, Berlin did not trigger Article 4. (Welt ↗, Il Manifesto ↗)
According to Tagesspiegel, two ministers softened the response. Chancellor Merz supposedly wanted a tougher reaction to Leipzig, but Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul slowed him down - which adds to the picture from previous days, when Merz stayed silent and sent ministers in front of the cameras. Welt writes that Germany is failing itself when it comes to protecting airports, describing it as "deaf, blind, toothless". Kyiv Post recalls that the case has also revived pressure for a visa ban for Russians across the Union. (Tagesspiegel ↗, Welt ↗, Kyiv Post ↗)
Moscow has moved from rhetoric to action: it is shutting down the Goethe-Institut. Foreign Minister Sergei Lavrov announced the end of Germany's cultural presence in Russia in retaliation for German sanctions; Berlingske specifies that the move concerns branches in three cities. On the German side, employees of the Russian House in Berlin are also to leave the country. Before that, the Russian Foreign Ministry summoned the German embassy's chargé d'affaires, Putin attacked Chancellor Merz personally, and Dmitry Medvedev threatened "strikes on military factories" in Germany; Macedonian media quote his newer statement that "neo-Nazis deserve a direct hit on Berlin". At home, meanwhile, Merz is facing criticism from the opposite side: Sahra Wagenknecht and AfD candidate Ulrich Siegmund claim that the measures are taking the country closer to war. (Spiegel ↗, Berlingske ↗, taz ↗, Libertas ↗)
Putin overnight accused Berlin of planting the evidence and called the German sanctions a "serious mistake". At a press conference in Kyrgyzstan's Bishkek, he denied Russian involvement and linked the incident to the internal crisis in Germany. The Russian ambassador in Berlin is threatening a response to the "unprecedented escalation". (Tagesschau ↗, n-tv ↗, 24 Chasa ↗)
Chancellor Merz has not publicly joined the accusation. German media note that he remains silent while ministers handle the confrontation with Russia; according to n-tv, the government is "keeping the ball low". (Welt ↗, n-tv ↗)
The response may also have a second, quieter dimension: intelligence. According to n-tv, the German Federal Intelligence Service could soon provide Kyiv with target data for attacks against Russia. If confirmed, that would be a bigger shift than any of the announced sanctions measures - and exactly the kind of action that is not announced publicly. (n-tv ↗)
Belgium has summoned the Russian ambassador, and Macron is calling for new European sanctions. Belgian Foreign Minister Maxime Prévot calls it an "extremely serious hostile act" and expressed full solidarity with Germany. Croatia and Montenegro also joined in. (7sur7 ↗, 24 Chasa ↗, Novi list ↗, N1 Bosna ↗)
Warsaw opens proceedings over foreign intelligence
Polish authorities went furthest on the legal front, one day earlier than Berlin. The hall of WB Electronics in Skarżysko-Kamienna burned shortly after midnight on Monday. According to the prosecutor's office, cameras captured an unknown person in a balaclava crossing the fence, and the fire is said to have been deliberately set by placing a device with an incendiary charge. The damage amounts to at least fifteen million zlotys. Al Jazeera ↗, Euronews ↗The prosecutor's office opened an investigation into participation in the activities of a foreign intelligence service directed against the Republic of Poland and into an offence of a terrorist nature. It did not name the specific intelligence service or state in this proceeding. On Wednesday, Prime Minister Donald Tusk confirmed from his position that the fire at the drone factory was, in his view, a case of sabotage and that Russia is escalating, according to Warsaw. No accusation against any specific person has yet been made. Het Laatste Nieuws ↗ The report was picked up by Greek and Bulgarian media, which placed it in the same frame as the German cases. Protothema ↗, 24 Chasa ↗
Danish counterintelligence described how such perpetrators are recruited: online. PET warns that Russia is preparing sabotage against Denmark's defence industry and is hiring "unaware" people recruited online to carry it out - a model that would explain why the sponsor is so hard to identify in individual cases. Commission President Ursula von der Leyen simultaneously said that attempts at Russian sabotage in Europe will increase. (Politiken ↗, Süddeutsche Zeitung ↗, LSM ↗)
Limits of this view
Three cases in two days are not proof of one coordinated operation. In Leipzig, it is no longer just what the media write, but the government's conclusion - yet that rests on intelligence information that has not been published, so it cannot be verified from the outside. Russia denies involvement and speaks of provocation. Identifying the two suspects changes less than it seems: the names come from media-reported findings of the investigation, not from an indictment, and neither of them has been charged or detained yet. In the substation cases, the evidentiary line actually runs in the opposite direction to the Russian narrative - in Brandenburg and in Bergheim, the authorities are openly working with a far-left version. The fact that both cases show parallels currently means only that they may be connected; no one has said who is behind them. The Polish prosecutor's office formulated the suspicion in a way that includes foreign intelligence, but no specific state is named in it. This is the last update to this article. The case is now branching into separate stories - EU visa policy, the series of attacks on substations, the Polish proceedings - and further developments will therefore go into new texts, not here.It is also worth noting how the Brandenburg incident is being described. Hungarian and Bosnian media wrote about a "rocket attack" on one of Germany's largest power plants, which sounds like an air strike on the plant itself. The description given by the authorities in the afternoon is different: the homemade devices were placed directly at the substation ten kilometres from the power plant and were only meant to fire conductive material into the wires. The difference between a "rocket attack on a power plant" and a "short circuit at a substation" is substantial and gets lost in the first hours after the incident. Even the German authorities were inconsistent - the police spoke of a detonation in the morning, and the state interior minister denied that in the afternoon.
What hotinfo is watching
- Polish prosecutors charged a specific individual over the fire at the WB Electronics factory.
- The German government announced concrete measures against Russia over the attack in Leipzig, and it is known whether they include steps outside the EU sanctions framework.Naplnené vlnou 1 (1.9.2026 19:30): päť krokov, z toho štyri mimo sankčného rámca EÚ — zatvorenie konzulátu v Bonne k 18.9., vypovedanie zmluvy s Ruským domom, sprísnené vstupné kontroly a tlak na tieňovú flotilu; piaty je presadzovanie sankcií v EÚ.
- The German government officially and by name identified who was behind the drone attack on Leipzig/Halle airport.Naplnené vlnou 1 (1.9.2026 19:30): minister vnútra Alexander Dobrindt na tlačovej konferencii vyhlásil, že za pokus o útok zodpovedá Rusko.
- Brandenburg's state criminal police office named who was behind the attack on the Turnow-Preilack substation.→ V Nemecku zadržali podozrivého z útokov na elektrickú sieť. Priznávací list s j…Pôvodcu pomenovala pri zadržaní severorýnsko-vestfálska polícia — 48-ročný Daniel V., ktorému vyšetrovatelia pripisujú priznávacie listy a aj dva skraty na rozvodni Turnow-Preilack. Brandenburský krajinský úrad kriminálnej polície sa samostatne nevyjadril a motív zostáva predmetom vyšetrovania.
- After the power grid, another incident occurred outside arms plants, confirming that the choice of targets has shifted.Naplnené vlnou 3 (2.9.2026 17:18): k brandenburskej rozvodni pribudla druhá v Bergheime pri Kolíne — šesť odpaľovacích zariadení, rovnaký princíp so skratom. Handelsblatt hovorí o „sérii útokov proti energetickým dodávkam", FAZ o paralelách medzi oboma prípadmi. Výber terčov sa teda posunul zo zbrojárskych podnikov na uzly siete.
Illustrative photo: the Jänschwalde power plant near Heinersbrück, November 2005. Author Dguendel, Wikimedia Commons, CC BY 4.0.
