2024-2026 European parcel bomb plot
The 2024-2026 European parcel bomb plot was a series of sabotage operations executed using incendiary devices that were hidden in parcels shipped through international courier networks in Europe and the UK. Joint investigation by German, Polish, Dutch, British and Lithuanian detectives have linked these incidents to individuals suspected of working for the Russian intelligence services, particularly the GRU (Russia’s military intelligence agency). The devices either ignited or exploded in courier depots in Germany, Poland, and the United Kingdom during 2024. European investigation suggesting these incidents were part of a coordinated plan, testing the vulnerability of international cargo transport systems. As of 2026, the investigations led to over twenty suspects that were part of the network.
Background
After Russia launched its full scale attacks on the Ukraine, European intelligence services started reporting about an increase in Russian hybrid warfare and sabotage operations throughout Europe. The rise of incidents included cyberattacks, disinformation campaigns, suspected arson attacks, and attempts to disrupt logistics infrastructure. They also claimed that transport and logistics networks including railways, ports, and cargo aviation hubs, are highly potential targets, as they are an important link in Europe's supply chain and ,military support for Ukraine. Latest reports claim test parcels and packages were detected on their way to UK and Poland, United States and Canada.
Incidents
Since 2024 several European nations who are NATO members experienced incidents involving parcel bombs or explosives, that were sent via civilian logistic systems.
Germany
In July 2024, at a major DHL cargo hub at Leipzig/Halle Airport an incendiary device that was hidden in a parcel ignited, causing a fire. This took place shortly before it was meant to be loaded onto am aircraft. According to authorities a major catastrophe could have accrued had it ignited during flight.
United Kingdom
In 2024, Birmingham, England, a parcel ignited at a DHL logistics facility with no injuries reported. Following the incident a counter terrorism investigation by British authorities was initiated. Investigators determined that the fire had been caused by a concealed incendiary device.
Poland
In Poland a suspicious parcel was reported at a logistics warehouse approximately at the same time, another exploded according to reports. Following an investigation European investigators linked the incident as part of the coordinated network of shipments.
Investigation
Following these events, a joint investigation began, conducted by German, British, Dutch and Lithuanian investigators. During March 2026, the Lithuanian prosecutors charged several suspects accused in participating in the network shipping explosives or incendiary parcels through courier systems. According to the investigators, some parcels had been mailed from Vilnius, Lithuania, and routed through major European cargo hubs.
Additional investigations revealed that the members of the network were recruited from Russia, Latvia, Estonia, Lithuania and Ukraine. It seems they all came from or were in a “vulnerable socio-economic situation”. As of March 2026, 22 individuals were identified as possible members or facilitators of the network. They were recruited online and paid small sums of money for delivering the packages. Investigators believe the operation may have been intended as a test of how explosive devices could move through international parcel delivery systems.
Alleged Russian involvement
According to the European intelligence services, the parcel bomb plot, has a similar Modus Operandi to other operations conducted by Russia’s military intelligence service, the GRU. They believe that the network was directed or supported by Russian intelligence operatives, who were trying to test the vulnerabilities in the international European logistics systems, disrupting European transport infrastructure, and intimidating countries supporting Ukraine. The Russian government has denied involvement, calling the accusations politically motivated.
See also
- Hybrid warfare
- Active measures
- Vulkan files leak