Romanian Intelligence Says It Has Documented More Sabotage Cases Than Publicly Disclosed

Romania's domestic intelligence service has documented more sabotage operations and preparations for attacks than it has publicly disclosed, according to a new statement issued on October 28, raising concerns about the scale of suspected clandestine operations targeting the country's strategic infrastructure.

The Romanian Intelligence Service (SRI) said it had identified multiple cases since Russia's full-scale invasion of Ukraine in 2022, working alongside Romanian law enforcement agencies and international intelligence partners.

In comments provided to Romanian public broadcaster TVR, SRI spokesperson Ovidiu Marincea confirmed that the service had publicly reported four separate cases since 2024 but had investigated additional incidents that remain undisclosed.

The agency has not specified the total number of cases, their locations or whether the additional operations were completed attacks or preparations detected before execution.

Intelligence Service Points to Wider Sabotage Campaign

SRI said its investigations indicate that the incidents are part of a broader campaign coordinated from Russia and directed against Romania and other European countries.

The intelligence service has previously identified military facilities, defense manufacturing sites and infrastructure supporting Ukrainian forces among the potential targets.

Its latest disclosure follows the investigation into a September 14 fire at an industrial complex in Brașov, near the state-owned CARFIL arms factory.

As AdriaDefense reported on October 28, Romanian authorities identified a suspected sabotage network involving two Belarusian nationals and one Ukrainian citizen.

Two suspects were detained in Germany, while a third was located in Poland. Romania is pursuing their extradition.

The investigation prompted Romania's Foreign Ministry to summon the Russian ambassador on October 27. The Russian Embassy rejected the allegations and disputed the evidence presented by Romanian authorities.

The latest SRI statement broadens the public picture beyond the Brașov incident by confirming that additional suspected operations have been documented.

Recruitment Through Social Media and Criminal Intermediaries

In an earlier statement issued on October 26, SRI provided details about methods allegedly used by sabotage networks operating across Europe.

According to the agency, recruitment can begin through social media, where individuals are offered relatively small payments to photograph or observe sensitive facilities.

The assignments may subsequently escalate to more serious activities, including destruction of property and arson.

SRI said such networks frequently exploit financial vulnerabilities, existing criminal backgrounds and other circumstances that make individuals susceptible to recruitment.

Investigators have also encountered the use of third-party travel arrangements, accommodation bookings, payment methods and encrypted messaging services.

The intelligence service cautioned that these characteristics must be assessed together and in context. Individually, they do not establish involvement in criminal activity.

The recruitment model presents challenges for companies operating sensitive facilities because individuals carrying out surveillance or physical attacks may have little visible connection to those directing the operation.

Defense Manufacturers Among Potential Targets

The threat is particularly relevant to companies involved in arms production, ammunition manufacturing and military logistics.

Romania has a significant defense manufacturing sector, including state-owned ROMARM subsidiaries and private companies supplying military technologies.

SRI has warned that potential targets extend beyond production sites to facilities used by international military personnel and for the training of Ukrainian armed forces.

Similar security concerns have emerged elsewhere in Europe. In September, AdriaDefense reported that Estonia attributed an arson attack on Milrem Robotics to Russian security services.

The Estonian case and the Romanian investigations are separate proceedings. Authorities have not established that the same network was responsible.

For companies operating within European defense supply chains, the Romanian disclosure highlights the growing importance of identifying suspicious approaches to employees, documenting security incidents and reviewing exposure at facilities and logistics partners.

SRI has not announced when further information about the additional cases may be released. Investigations remain ongoing in cooperation with Romanian and international authorities.

Sources: Romanian Television (TVR), October 28, 2026; Romanian Intelligence Service (SRI), October 26, 2026.