{
  "id": "6b5fc424-6805-4c59-a410-fbd8c5d143fc",
  "url": "https://militarnyi.com/en/news/russian-suspected-of-cyberattacks-on-polish-and-eu-companies-detained-in-krakow",
  "source": "admin_quick",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Poland",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "cyberattacks",
    "Poland",
    "Russia",
    "Cybercrime",
    "Krakow",
    "European Union",
    "CBZC",
    "IT systems",
    "Unauthorized access"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": "Russian Suspected of Cyberattacks on Polish and EU Companies Detained in Krakow",
  "description": "A 23-year-old Russian citizen suspected of conducting cyberattacks on Polish and European companies was detained in Krakow, Poland, on November 16, 2025. The suspect, who worked as a truck driver, reportedly hacked into the IT systems of an online retailer, altering database structures which could have severely affected business operations and customer data security. Investigators found some attacks were launched from the restroom of the truck the suspect used while traveling across Europe. The Central Bureau for Combating Cybercrime (CBZC) is investigating further potential connections to other attacks in Poland and EU states. The suspect illegally crossed the Polish border in 2022, was granted refugee status in 2023, and claims financial motivation for his actions. The court in Krakow ordered three months of detention during ongoing investigations. Polish Interior Minister Marcin Kierwinski confirmed these facts publicly.",
  "summary_short": "A 23-year-old Russian citizen was detained in Krakow on November 16, 2025, for suspected cyberattacks on Polish and EU companies, involving unauthorized IT system access and database manipulation.",
  "summary_extended": "On November 16, 2025, Polish authorities detained a 23-year-old Russian national suspected of interfering with IT systems of Polish and European companies. According to the Central Bureau for Combating Cybercrime (CBZC), the suspect, who worked as a truck driver, hacked into the security frameworks of an online retailer, altering its databases, which risked disrupting business operations and compromising customer data. Investigations revealed some attacks originated from the restroom of his truck during his travels across Europe. Prosecutors are exploring links to additional intrusions across the EU. The detainee illegally crossed into Poland in 2022 and was granted refugee status a year later. He cited financial motives for the attacks. A court in Krakow imposed a three-month detention to secure the investigation. Polish Interior Minister Marcin Kierwinski publicly acknowledged the case. Authorities have not ruled out further charges or arrests connected to this cybercrime operation.",
  "actor_primary": "23-year-old Russian citizen suspect",
  "target_primary": null,
  "location_text": "Krakow",
  "location_region": null,
  "location_coordinates_lat": 50.0647,
  "location_coordinates_lon": 19.945,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly involves a discrete cyberattack operation linked to a Russian suspect targeting Polish and EU companies, with official detainment and a court order. This indicates active aggressor activity by a hostile actor in cyberspace.",
  "event_time_utc": "2025-11-16T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-02-14T12:22:51.838Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "6b5fc424-6805-4c59-a410-fbd8c5d143fc",
  "url": "https://militarnyi.com/en/news/russian-suspected-of-cyberattacks-on-polish-and-eu-companies-detained-in-krakow",
  "source": "admin_quick",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Poland",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "cyberattacks",
    "Poland",
    "Russia",
    "Cybercrime",
    "Krakow",
    "European Union",
    "CBZC",
    "IT systems",
    "Unauthorized access"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": "Russian Suspected of Cyberattacks on Polish and EU Companies Detained in Krakow",
  "description": "A 23-year-old Russian citizen suspected of conducting cyberattacks on Polish and European companies was detained in Krakow, Poland, on November 16, 2025. The suspect, who worked as a truck driver, reportedly hacked into the IT systems of an online retailer, altering database structures which could have severely affected business operations and customer data security. Investigators found some attacks were launched from the restroom of the truck the suspect used while traveling across Europe. The Central Bureau for Combating Cybercrime (CBZC) is investigating further potential connections to other attacks in Poland and EU states. The suspect illegally crossed the Polish border in 2022, was granted refugee status in 2023, and claims financial motivation for his actions. The court in Krakow ordered three months of detention during ongoing investigations. Polish Interior Minister Marcin Kierwinski confirmed these facts publicly.",
  "summary_short": "A 23-year-old Russian citizen was detained in Krakow on November 16, 2025, for suspected cyberattacks on Polish and EU companies, involving unauthorized IT system access and database manipulation.",
  "summary_extended": "On November 16, 2025, Polish authorities detained a 23-year-old Russian national suspected of interfering with IT systems of Polish and European companies. According to the Central Bureau for Combating Cybercrime (CBZC), the suspect, who worked as a truck driver, hacked into the security frameworks of an online retailer, altering its databases, which risked disrupting business operations and compromising customer data. Investigations revealed some attacks originated from the restroom of his truck during his travels across Europe. Prosecutors are exploring links to additional intrusions across the EU. The detainee illegally crossed into Poland in 2022 and was granted refugee status a year later. He cited financial motives for the attacks. A court in Krakow imposed a three-month detention to secure the investigation. Polish Interior Minister Marcin Kierwinski publicly acknowledged the case. Authorities have not ruled out further charges or arrests connected to this cybercrime operation.",
  "actor_primary": "23-year-old Russian citizen suspect",
  "target_primary": null,
  "location_text": "Krakow",
  "location_region": null,
  "location_coordinates_lat": 50.0647,
  "location_coordinates_lon": 19.945,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly involves a discrete cyberattack operation linked to a Russian suspect targeting Polish and EU companies, with official detainment and a court order. This indicates active aggressor activity by a hostile actor in cyberspace.",
  "event_time_utc": "2025-11-16T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-02-14T12:22:51.838Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}