On Thursday, April 2, 2026, Polish prosecutors announced that on March 25, 2026, an indictment against five people had been filed with the Warsaw-Praga District Court in Warsaw in an investigation into an organized criminal group accused of carrying out acts of sabotage and terrorist offenses on behalf of Russian intelligence.
Extinguishing the fire after the arson attack on the Marywilska 44 shopping center in Warsaw / Photo: Section Officer Krzysztof Pisz, Press Office of the National Headquarters of the State Fire Service
The investigation established that an organized group was operating in Poland, Lithuania, Latvia, and other European countries with the aim of committing sabotage and terrorist offenses by setting fire to large retail facilities. These acts were intended to seriously intimidate large numbers of people and, as a consequence, influence public opinion (Article 258 § 2 of the Criminal Code). Those alleged to have belonged to the organized group include defendants Daniil B., Oleksandr H., and Vitalii K., as well as Serhii R., Pavlo T., and Vladyslav Y., who were convicted in a separate trial, and the wanted suspects Serhii Chalyi and Oleksandr Varyvoda.
This indictment covers acts involving participation in the following sabotage attacks:
- the arson attack on the OBI store on Radzymińska Street in Warsaw, Poland, on April 13–14, 2024;
- the arson attack on the IKEA store in Vilnius, Lithuania, on May 9, 2024;
- the arson attack on the Marywilska 44 shopping center in Warsaw, Poland, on May 12, 2024;
- preparations in May 2024 for an arson attack on the IKEA store in Riga, Latvia.
The defendants
The indictment covers five people:
- Daniil B. – 2 charges:
- participation in an organized criminal group focused on setting fire to large retail facilities (Article 258 § 2 of the Criminal Code);
- participation in sabotage attacks involving the arson of the IKEA store in Vilnius, filming the fire at the Marywilska 44 shopping center, and preparations for setting fire to the IKEA store in Riga (Article 130 § 7 of the Criminal Code in conjunction with Article 65 § 1 of the Criminal Code).
- Oleksandr H. – 2 charges:
- participation in an organized criminal group focused on setting fire to large retail facilities (Article 258 § 2 of the Criminal Code);
- participation in a sabotage attack involving the arson of the IKEA store in Vilnius by constructing and using an incendiary device, as well as participation in preparations for further arson attacks (Article 130 § 7 of the Criminal Code in conjunction with Article 163 § 1(1) of the Criminal Code).
- Stepan K. – 1 charge:
- carrying out a sabotage attack involving the arson of the OBI store on Radzymińska Street in Warsaw (Article 130 § 7 of the Criminal Code in conjunction with Article 163 § 1(1) of the Criminal Code).
- Vitalii K. – 4 charges:
- participation in an organized criminal group focused on setting fire to large retail facilities (Article 258 § 2 of the Criminal Code);
- aiding and abetting the arson of the IKEA store in Vilnius by providing transportation and logistical support enabling the perpetrators and components of the incendiary device to be transported (Article 18 § 3 of the Criminal Code in conjunction with Article 163 § 1(1) of the Criminal Code);
- obstructing criminal proceedings by helping a perpetrator evade responsibility after the arson-related incidents, including organizing an escape and hiding vehicles (Article 239 § 1 of the Criminal Code);
- committing battery in Wólka Kosowska (Article 158 § 1 of the Criminal Code).
- Pavlo T. – 1 charge:
- aiding and abetting battery in Wólka Kosowska (Article 18 § 3 of the Criminal Code in conjunction with Article 158 § 1 of the Criminal Code).
Stepan K. is a Belarusian citizen; the remaining defendants are Ukrainian citizens.
The offense under Article 130 § 7 of the Criminal Code carries a penalty of imprisonment for no less than 10 years or life imprisonment.
Arson attack on the OBI store in Warsaw
On April 14, 2024, the OBI large-format retail store at 166 Radzymińska Street in Warsaw was set on fire.
The evidence suggests that the perpetrator of the arson was Belarusian citizen Stepan K.
The findings indicate that on April 13, 2024, he placed in the building a device enabling the fire to be started remotely. During the night of April 13–14, 2024, the device was activated, causing the fire.
As a result of the incident, part of the store burned down and the damage exceeded 3.5 million zlotys. The perpetrator recorded his actions on a cell phone in order to document the sabotage attack, and some of the material was later published on Russian propaganda websites.
Stepan K. was charged with carrying out this sabotage attack on behalf of the foreign intelligence service of the Russian Federation.
Arson attack on the IKEA store in Vilnius
The proceedings established that from April 20, 2024, Daniil B., acting on the instructions of those directing the group, stayed in the Republic of Lithuania and conducted reconnaissance of large retail stores in order to determine whether incendiary devices could be left there.
After conducting the reconnaissance, he returned to Warsaw and then traveled back to Lithuania together with Oleksandr H. On May 8, 2024, acting on instructions, they constructed incendiary devices enabling a fire to be started remotely, and these were left in the IKEA store in Vilnius together with flammable liquid.
During the night of May 8–9, 2024, the devices caused a fire at the facility. According to the findings, the perpetrators acted according to an established pattern that also included documenting the incident: they recorded the fire and the rescue operation and passed the material on to those directing the group’s activities for use in propaganda messaging.
Immediately after committing the crime, the perpetrators returned to Warsaw. Vitalii K. provided them with logistical assistance in carrying out this act.
Arson attack on the Marywilska 44 shopping center in Warsaw
During the night of May 12, 2024, a fire broke out at the Marywilska 44 shopping center in Warsaw.
On May 11, 2024, Daniil B. received instructions from Oleksandr V., who was in the Russian Federation, to go near the Marywilska 44 shopping center in Warsaw and record the fire in the hall and the response of firefighting and rescue services. The fire at Marywilska 44 in Warsaw broke out on May 12, 2024. Daniil B. carried out the assignment, recorded the fire in the Marywilska 44 hall, and then sent the recording to Oleksandr V.
The proceedings established that the fire at the hall on Marywilska 44 was the result of arson committed by members of an organized criminal group acting on behalf of the intelligence service of the Russian Federation. The direct perpetrators of the arson have not yet been identified. The investigation in this respect is continuing.
Preparations for an arson attack on the IKEA store in Riga
In May 2024, Daniil B., acting on the instructions of those directing the organized criminal group, took steps aimed at carrying out another sabotage attack: setting fire to the IKEA store in Riga, in the Republic of Latvia.
To that end, he accepted instructions to travel to Vilnius to collect incendiary devices prepared earlier, which, according to the instructions he received, were then to be used to start a fire at the IKEA store in Riga.
After collecting the devices, Daniil B. was to travel to Riga and set fire to the facility as part of sabotage activities carried out on behalf of the foreign intelligence service of the Russian Federation.
This plan was not carried out because Daniil B. was arrested while still in the Republic of Lithuania.
Further Investigation
The investigation is continuing with respect to matters not covered by this indictment.
Its main purpose is to identify the remaining individuals who participated in any way in the arson attack on the hall at Marywilska 44 in Warsaw, including those who ordered it and its direct perpetrators.
The purpose of these proceedings is also to arrest and bring charges against the two remaining suspects not covered by the indictment: Serhii Chalyi and Oleksandr Varyvoda.
The evidence gathered has made it possible to prepare decisions presenting Serhii Chalyi and Oleksandr Varyvoda with charges of directing an organized criminal group and coordinating sabotage activities involving the arson of large retail facilities in Poland, Lithuania, and other European Union member states on behalf of the foreign intelligence service of the Russian Federation.
These charges have not yet been served on them because they are in hiding from law enforcement. They are wanted under European Arrest Warrants and wanted notices.
W zakresie nieobjętym niniejszym aktem oskarżenia śledztwo jest kontynuowane.
First indictment and conviction
This is another indictment in this case. The first was filed on April 25, 2025, against Serhii R., Pavlo T., and Vladyslav Y.
In that case, on September 18, 2025, the Warsaw-Praga Regional Court in Warsaw convicted the three Ukrainian nationals (Serhii R., Pavlo T., and Vladyslav Y.) of participation in an organized criminal group engaged in sabotage and terrorism.
All three defendants (Serhii R., Pavlo T., and Vladyslav Y.) were convicted of participating, during various periods in 2023–2024, in an organized group operating in Poland, Lithuania, Latvia, Ukraine, and Russia, whose aim was to commit sabotage and terrorist offenses involving the arson of large retail facilities located in European Union member states (Article 258 § 2 of the Criminal Code). These offenses were committed with the aim of seriously intimidating large numbers of people and influencing public opinion. The defendants acted jointly and in concert with one another and with other identified individuals against whom proceedings are continuing.
In addition, Serhii R. and Pavlo T. were also convicted of obstructing the investigation into the arson attack on the IKEA store in Vilnius (May 9, 2024) and the hall at Marywilska 44 in Warsaw (May 12, 2024) by helping Serhii Chalyi evade criminal liability between May 13 and 17, 2024, primarily by assisting him in leaving the territory of the Republic of Poland (Article 239 § 1 of the Criminal Code).
Cooperation between services and prosecutors’ offices
The investigation is being conducted by prosecutors from the Mazovian branch in Warsaw of the Department for Organized Crime and Corruption of the National Prosecutor’s Office, together with officers from the Criminal Terror and Homicide Unit of the Warsaw Metropolitan Police Headquarters, the Investigation Division of the Warsaw Metropolitan Police Headquarters, and officers of the Internal Security Agency.
The case is also being handled in close cooperation with prosecutors’ offices and law enforcement authorities from other European countries. On August 9, 2024, an agreement was concluded establishing a Joint Investigation Team (JIT), covering preparatory proceedings conducted in several European countries concerning the arson of large retail stores. The purpose of the JIT is to coordinate investigative activities, including joint planning and carrying out procedural actions, and to improve the exchange of information and evidence between law enforcement authorities.
Więcej informacji w komunikacie @PK_GOV_PL ⬇️https://t.co/NjqafzMACC
— Waldemar Żurek (@w_zurek) April 3, 2026
See also:
- Poland’s Internal Security Agency detains Polish citizens in connection with an arson attack on the territory of the Czech Republic
- Polish Prime Minister Donald Tusk: Two Acts of Sabotage targeting Poland’s Railways
- Polish Security Services Detain Eight People Preparing Sabotage Operations
- Russia-Backed Colombian Behind Terror Attacks in Poland, According to Polish Authorities