The attacker is seventeen. The order came from abroad.

What happened

On 28 February 2026 the United States and Israel struck Iran; Iran responded with missile and drone strikes. A ceasefire followed in the spring, with violations reported since. Within a week, Europol warned that the war has “immediate repercussions” for security in the EU: a raised terrorism threat, more cyber-attacks on infrastructure, more fraud and disinformation.

• 9 March, Liège: a device exploded at the entrance of a synagogue in the night. Damage, no injuries.
• 13 March, Rotterdam: an explosion and fire at a synagogue. Four young people aged 17 to 19 were arrested near another synagogue.
• 14 and 16 March, Amsterdam: an explosive against the wall of a Jewish school; two nights later, a bomb at the office building of an American bank.
• 20 March, Heemstede: a planned attack on a synagogue was foiled. Boys of 14 and 17 were arrested.
• 23 March, Antwerp: a car was set on fire in the Jewish quarter. Two minors were arrested within fifteen minutes.
• 28 March, Paris: police stopped a man trying to ignite a fuel device outside an American bank. Four people were charged, three of them minors.

A group calling itself Harakat Ashab al-Yamin al-Islamiya claimed the attacks. The Dutch counter-terrorism coordinator counted fifteen claimed arson attacks in Europe in March and April, five of them in the Netherlands, “possibly planned by a man linked to the Iranian Revolutionary Guard and carried out by criminals”. In May, the US Justice Department charged a man it says coordinated some eighteen attacks in Europe. Belgium’s threat analysis centre OCAM says the perpetrators in Liège and Antwerp “certainly followed Iran’s call”.

Attacks as a gig

The pattern itself is not new: Swedish, Dutch, British and French services have warned for years that Iran uses criminal networks as proxies. What March showed is how cheap and fast it has become.

• Recruited online. Suspects were approached via social media. In Rotterdam, prosecutors say they were offered €3,000; in Paris, the minors were allegedly promised €500 to €1,000.
• Young and replaceable. Most of those arrested were teenagers or young adults. The one who pays is never at the scene.
• One method, many places. A device at an entrance, in the middle of the night: repeated in several cities and three countries within three weeks. In Rotterdam, the suspects messaged each other “on the way to number 2”.

For the police, every incident starts as a local case: an arson, an explosion, a report. The series only becomes visible when the cases are laid next to each other — across cities, forces and countries.

What caught them

• Being at the next target. In Rotterdam, officers guarding other synagogues spotted a car driving erratically twenty minutes after the blast.
• Camera images. In Amsterdam, police published surveillance images of a fatbike; weeks later, a 17-year-old was arrested.
• Speed. In Antwerp, the suspects were arrested within fifteen minutes. In Paris, the man was caught in the act.
• Links across borders. OCAM connects the Belgian cases to Dutch plots. The US case rests on seized devices and social-media accounts.

Protection has been stepped up since. Belgium deployed more than fifty soldiers at some twenty synagogues and four Jewish schools; the Netherlands raised its security budget for Jewish institutions; France ordered “dynamic surveillance” of places of worship, schools and American and Israeli interests. That means many sites, guarded by many organisations — police, army, private security and the communities themselves.

With one shared picture

• Every protected site on one map. Synagogues, schools and offices with their cameras, alarms and patrols — so every unit sees which sites are close and who is guarding them.
• The next target, before the attacker gets there. When an incident happens at 03:40, nearby protected sites are alerted straight away and the dispatcher sees which patrols are closest.
• Incidents that recognise each other. Time, method, target and claim are recorded the same way for every incident, so a new case is compared with earlier ones — in other police zones too and, where agreements allow, in other countries.

From recruit to handler

Meridian doesn’t catch anyone; police and prosecutors do. What changes is where they start.

1. 01

   Follow the route

   Cameras, ANPR and patrol reports around the scene are placed on one timeline. Where did the fatbike or the car come from, and where did it go? The route of that night becomes visible in minutes, not after days of collecting footage.

2. 02

   Connect the recruits

   Devices, accounts and payments seized in one case are compared with other cases: the same handler, the same account, the same instructions. That is how teenagers in three countries become one network.

3. 03

   Work towards the handler

   The one who pays is abroad and never at the scene. What leads there is the sum of small traces — which is why the cases have to be read together, not one by one.

4. 04

   Within the law

   Searching devices and accounts is sensitive. In Meridian, every query is purpose-bound and logged: who asked what, on which legal basis. That protects the case in court — and the citizens who are not suspects.

The attacks of March were cheap to order and easy to repeat. What makes the difference is how quickly the people protecting a city see them as one series.