Latvian State Security Service initiated prosecution against four individuals for arson attacks on Latvian railway infrastructure in favor of Russia, with multiple incidents recorded between October 2025 and January 2026, causing significant operational damage.

Energy & Infrastructure AttacksCritical Infrastructure SabotageTransport hubs (rail, airports)

Aggressor

Summary

On May 21, 2026, the Latvian State Security Service (VDD) proposed criminal prosecution against four individuals accused of malicious arson attacks on Latvian railway infrastructure objects in the interests of Russia. Three suspects were detained in January 2026 in cooperation with the State Police, while the fourth, acting as an intermediary coordinating task execution and payment, was already imprisoned for unrelated crimes. The arsons include deliberate burning of electrical distribution cabinets responsible for railway lighting and relay cabinets controlling train movement, with incidents recorded by video and evidence shared with the task issuer via Telegram. Four cases of railway object arson were found: three in October 2025 and one in January 2026. The criminal case was taken over by VDD for further investigation on February 6, 2026, after proving the acts were committed in favor of a foreign state. The suspects face charges of aiding a foreign state against Latvia and intentional destruction of property by arson. Separately in March 2026, two young Latvian men born 1999 and 2006 were charged for similar acts of railway infrastructure arson to the tune of approximately 372,014 euros in damages, involving burning relay cabinets, lighting distribution cabinets, and a diesel locomotive using plastic bottles filled with fuel. Deductive evidence shows a coordinated effort with some acts carried out individually and other in group, aiming to disrupt critical railway control systems in Riga.

Classification

Confidence: High

The coordinated malicious arson attacks targeted key railway infrastructure critical for train operation and control, were committed in service of a foreign power (Russia), and were prosecuted by state security authorities, indicating hostile hybrid warfare activity.

Source URL

https://lasi.lv/par-svarigo/latvija/rosina-sakt-kriminalvajasanu-par-latvijas-dzelzcela-objektu-dedzinasanu-krievijas-intereses.42745

Open source

Provenance

Publisher: extension
Submitted: May 26, 2026, 10:14 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Oct 1, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "db17271d-003e-41af-ac16-72bd2f968080",
  "url": "https://lasi.lv/par-svarigo/latvija/rosina-sakt-kriminalvajasanu-par-latvijas-dzelzcela-objektu-dedzinasanu-krievijas-intereses.42745",
  "source": "extension",
  "status": "approved",
  "category": "Energy & Infrastructure Attacks",
  "subcategory": "Critical Infrastructure Sabotage",
  "incident_type": "Transport hubs (rail, airports)",
  "country": "Latvia",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "arson",
    "railways",
    "Latvia",
    "Russia",
    "State Security Service",
    "VDD",
    "infrastructure attack",
    "hybrid warfare",
    "telegram"
  ],
  "nodes": [],
  "countries": [
    "Latvia"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "On May 21, 2026, the Latvian State Security Service (VDD) proposed criminal prosecution against four individuals accused of malicious arson attacks on Latvian railway infrastructure objects in the interests of Russia. Three suspects were detained in January 2026 in cooperation with the State Police, while the fourth, acting as an intermediary coordinating task execution and payment, was already imprisoned for unrelated crimes. The arsons include deliberate burning of electrical distribution cabinets responsible for railway lighting and relay cabinets controlling train movement, with incidents recorded by video and evidence shared with the task issuer via Telegram. Four cases of railway object arson were found: three in October 2025 and one in January 2026. The criminal case was taken over by VDD for further investigation on February 6, 2026, after proving the acts were committed in favor of a foreign state. The suspects face charges of aiding a foreign state against Latvia and intentional destruction of property by arson. Separately in March 2026, two young Latvian men born 1999 and 2006 were charged for similar acts of railway infrastructure arson to the tune of approximately 372,014 euros in damages, involving burning relay cabinets, lighting distribution cabinets, and a diesel locomotive using plastic bottles filled with fuel. Deductive evidence shows a coordinated effort with some acts carried out individually and other in group, aiming to disrupt critical railway control systems in Riga.",
  "summary_short": "Latvian State Security Service initiated prosecution against four individuals for arson attacks on Latvian railway infrastructure in favor of Russia, with multiple incidents recorded between October 2025 and January 2026, causing significant operational damage.",
  "summary_extended": null,
  "actor_primary": "Valsts drošības dienests (VDD)",
  "target_primary": null,
  "location_text": "Riga",
  "location_region": "Riga",
  "location_coordinates_lat": 56.9496,
  "location_coordinates_lon": 24.1052,
  "location_precision": "Exact",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The coordinated malicious arson attacks targeted key railway infrastructure critical for train operation and control, were committed in service of a foreign power (Russia), and were prosecuted by state security authorities, indicating hostile hybrid warfare activity.",
  "event_time_utc": "2025-10-01T00:00:00.000Z",
  "end_time_utc": "2026-01-31T23:59:59.000Z",
  "event_time_confidence": "pm24h",
  "created_at": "2026-05-26T10:14:00.520Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "exact",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Exact

Source reliability

Info credibility

Event time

Oct 1, 2025, 00:00 UTC

End time

Jan 31, 2026, 23:59 UTC

Event time confidence

pm24h

Location

Riga

Region

Riga

Primary actor

Valsts drošības dienests (VDD)

Country

Latvia

Countries

Latvia

Tags

arson, railways, Latvia, Russia, State Security Service, VDD, infrastructure attack, hybrid warfare, telegram

Loading signal...

{ "id": "db17271d-003e-41af-ac16-72bd2f968080", "url": "https://lasi.lv/par-svarigo/latvija/rosina-sakt-kriminalvajasanu-par-latvijas-dzelzcela-objektu-dedzinasanu-krievijas-intereses.42745", "source": "extension", "status": "approved", "category": "Energy & Infrastructure Attacks", "subcategory": "Critical Infrastructure Sabotage", "incident_type": "Transport hubs (rail, airports)", "country": "Latvia", "source_reliability": "C", "info_credibility": "3", "tags": [ "arson", "railways", "Latvia", "Russia", "State Security Service", "VDD", "infrastructure attack", "hybrid warfare", "telegram" ], "nodes": [], "countries": [ "Latvia" ], "where_text": "Land", "headline": null, "description": "On May 21, 2026, the Latvian State Security Service (VDD) proposed criminal prosecution against four individuals accused of malicious arson attacks on Latvian railway infrastructure objects in the interests of Russia. Three suspects were detained in January 2026 in cooperation with the State Police, while the fourth, acting as an intermediary coordinating task execution and payment, was already imprisoned for unrelated crimes. The arsons include deliberate burning of electrical distribution cabinets responsible for railway lighting and relay cabinets controlling train movement, with incidents recorded by video and evidence shared with the task issuer via Telegram. Four cases of railway object arson were found: three in October 2025 and one in January 2026. The criminal case was taken over by VDD for further investigation on February 6, 2026, after proving the acts were committed in favor of a foreign state. The suspects face charges of aiding a foreign state against Latvia and intentional destruction of property by arson. Separately in March 2026, two young Latvian men born 1999 and 2006 were charged for similar acts of railway infrastructure arson to the tune of approximately 372,014 euros in damages, involving burning relay cabinets, lighting distribution cabinets, and a diesel locomotive using plastic bottles filled with fuel. Deductive evidence shows a coordinated effort with some acts carried out individually and other in group, aiming to disrupt critical railway control systems in Riga.", "summary_short": "Latvian State Security Service initiated prosecution against four individuals for arson attacks on Latvian railway infrastructure in favor of Russia, with multiple incidents recorded between October 2025 and January 2026, causing significant operational damage.", "summary_extended": null, "actor_primary": "Valsts drošības dienests (VDD)", "target_primary": null, "location_text": "Riga", "location_region": "Riga", "location_coordinates_lat": 56.9496, "location_coordinates_lon": 24.1052, "location_precision": "Exact", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The coordinated malicious arson attacks targeted key railway infrastructure critical for train operation and control, were committed in service of a foreign power (Russia), and were prosecuted by state security authorities, indicating hostile hybrid warfare activity.", "event_time_utc": "2025-10-01T00:00:00.000Z", "end_time_utc": "2026-01-31T23:59:59.000Z", "event_time_confidence": "pm24h", "created_at": "2026-05-26T10:14:00.520Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "exact", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }