An explosion on the line. Found the next morning.

What happened

• 15 November 2025, Poland: an explosive went off under a freight train on the Warsaw–Lublin line, a route that is “very important for supplying Ukraine”. The driver did not notice; another driver reported the damage the next morning. The two suspects, who according to the Polish government worked for Russian services, had already left the country via Belarus.
• July 2024, Leipzig, Birmingham and Poland: incendiary parcels sent from Vilnius caught fire at DHL and DPD sites; more were found in Amsterdam. A joint investigation team of nine countries, the Netherlands among them, identified 22 suspects and attributes the plot to Russian military intelligence. Five people have been charged in Lithuania.
• 4 August 2026, Leipzig/Halle: an explosive-laden drone hit a Ukrainian cargo aircraft without detonating. It was flown over the mobile network, with a 5G router and SIM cards. On 1 September Germany attributed the attack to Russia; Russia denies it.
• September 2026: incendiary devices near two defence companies in Munich, a fire at a satellite ground station in Poland, and NATO jets shooting down an explosive drone over Lithuania.
• At sea: Dutch and Belgian services warn that Russia maps cables, pipelines and wind farms in the North Sea. In the Baltic, a ship dragged its anchor for some 90 kilometres in December 2024, damaging a power cable and four data cables.

Closer to home

According to the Dutch military intelligence service MIVD, there have been no physical Russian sabotage incidents in the Netherlands. But preparation has been increasing cautiously since the summer of 2025, mainly against military and logistic targets, and the Netherlands remains a target as a transport and information hub. Belgium’s State Security says the tasks given to recruits here have so far been low-impact, but “may escalate”; the first Belgian arrest of such a recruit followed in May 2026.

Dutch and Belgian services also report that Russia hacked private IP cameras along Dutch military routes, using default passwords and outdated software. The cameras meant to watch the route were watching for someone else.

And on 15 September 2026, metal pipes on the tracks at some 35 locations short-circuited the signalling and brought Dutch trains to a halt. There is no indication of a Russian link — reports point to activists. But it showed how hard it is to see what happens along the track: the rail operator’s cameras mainly cover level crossings, the justice minister said.

Disposable agents

Intelligence services describe layered networks: a coordinator abroad, facilitators in between, and at the bottom recruits who are sometimes minors, often unaware who they work for, and paid small amounts.

• In Poland, a man recruited through Telegram was paid the equivalent of €337 in crypto to prepare an arson attack on a warehouse. He was sentenced on 28 September.
• In the Netherlands, two 17-year-olds recruited through Telegram walked a route past Europol, Eurojust and an embassy with a device that captures wifi signals.
• Europol calls such recruits a “fire-and-forget weapon”.

The attacks are small, cheap and spread out. On its own, each one looks like vandalism, theft or a technical fault.

The new duty

Since 15 August 2026, Dutch law requires some 500 critical entities to assess their risks within nine months, take measures within ten, and report incidents within 24 hours. Belgium’s law on critical entities was published in January 2026, with the National Crisis Centre as coordinator; designated operators must draw up resilience plans. The Dutch counter-terrorism coordinator asks operators to share information with each other and with the government: it is “not a question of whether, but when”.

With one shared picture

• The whole line on one map. Signalling faults, trackside sensors, cameras, intrusion alarms and patrols in one picture — so 35 faults at once look like what they are: one act, not 35 tickets.
• A dark camera is a signal too. A signalling fault, a camera that stopped sending images and a fence alarm an hour earlier become one incident, checked by drone before crews drive out.
• Sharing without giving everything away. Operators, police and services each see the layers they are cleared for — the information-sharing the authorities ask for, without pooling all data.
• The 24-hour report writes itself. The timeline of every incident is built as it happens.

From incident to perpetrator

Meridian doesn’t catch anyone; police and prosecutors do. What changes is where they start.

1. 01

   Found in minutes, not the next morning

   When a signalling fault, a sensor alert and a camera outage coincide on one section, it is checked straight away by drone or by the nearest crew — and the scene is secured before traces disappear.

2. 02

   Reconstruct the preparation

   Saboteurs scout first: in Poland, one of the suspects was driven to the site weeks before. Laid over time, camera images, ANPR hits and patrol reports around a site show who came back, before and after.

3. 03

   Connect the small incidents

   A stolen cable, a photographed depot, a fire in a warehouse: separately they are local cases. Together, across operators and borders, they can reveal a campaign — as the nine-country investigation into the incendiary parcels did.

4. 04

   Evidence within the law

   Every query is logged: who asked what, and on which legal basis. What reaches the prosecutor — or the regulator — can be checked step by step.

The saboteur is paid a few hundred euros. The operator carries the legal duty. What makes the difference is who sees first that the small incidents belong together.