Summary, 2 November 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 2 November 2026, 21:58 UTC

Watchcon

Yellow · Significant concern

High confidence · Trend: Rising

Held at the Yellow level. Sabotage, drone incursions and ship strikes continue across the flank, and the pressure is rising in places, but no listed report describes an armed attack on allied territory. The conventional reading stays at level 1.

Key developments

Reports say at least eight merchant ships were attacked in the western Black Sea off Romania and Bulgaria in October, four sank, three sailors are dead and 31 are missing. This is harm in allied waters and keeps the Black Sea flank's maritime pattern rising. wiadomosci.wp.pl
Finland's security service said a state actor cannot be ruled out behind the refrigeration attacks, and Belgium opened a criminal investigation. No one has claimed them, so attribution stays open on the board. is.fi
Poland's police chief confirmed a special operation staff for Warmia-Masuria and Podlasie, after military intelligence and allied services warned of sabotage near the Kaliningrad border. It is preventive, and no sabotage is reported yet. rmf24.pl
Moldova logged 19 airspace violations in October, with drones exploding on the ground in several districts and in four Transnistrian localities. This confirms a steady drone spillover pressure on the Moldovan sector. moldpres.md
Romania scrambled F-16s and a Puma helicopter and sent a RO-Alert to Tulcea county on 2 Nov as mass drone strikes hit Ukraine's Danube ports. No intrusion into Romanian airspace was reported, so this is a cost imposed on allied air defence, not harm. x.com
NATO is stepping up Black Sea surveillance with patrol aircraft, radar and drones after the attacks on civilian ships near Romania and Bulgaria. It shows an allied response to the maritime pattern. x.com
Estonia expelled Russian citizen Leonid Karabeshkin and banned him from the Schengen area. Its security service said he had contacts with Russian special services and ran signs of influence operations, a counter-subversion move in the Baltic states. news.err.ee

Where sources disagree

Contship Jet: one report calls it a Greek-managed tanker with all 18 crew rescued, while another report counts three sailors dead and 31 missing among October's attacks. The two cover different scopes, ship and month.
Refrigeration attack reach: some reports count seven countries, one background report counts at least eight including Portugal. Finland's security service does not rule out a state actor, and no one has claimed it.
Poland's border operation: police call it preventive, while some reports describe a scenario of armed groups crossing the border. No crossing is reported.

Outlook

More drone strikes on merchant ships off Romania or Bulgaria are likely. Watch for a new sinking after the 28 Oct Contship Jet loss; another would hold the Black Sea maritime reading at level 2.
Another Russian-linked sabotage act in a supporting state is likely. Watch Poland's border operation and any new arson case like Brașov or the Starlink fires; a new act would keep the sabotage indicator at level 3, trend up.
Drones entering Moldovan or Romanian airspace will almost certainly recur. Watch for new air alerts in Tulcea or Neamț counties and Moldovan airspace limits; a drone landing in Romania would add pressure on the Black Sea air-strikes reading.
Further refrigeration cyberattacks on European retailers have a roughly even chance. Watch for new countries or sectors hit; a repeat would hold the High North hybrid reading at level 2.

Collection gaps

None filed in this summary.

In short

Supermarket fridges were hit by a cyberattack in seven countries. Shops in Estonia, Finland and Sweden were among those where thermostats were remotely raised, in some cases to 50C. Finland's security service does not rule out a state actor, and no one has claimed it. theguardian.com
Poland set up a special border operation near Kaliningrad. The police chief said officers, including counterterrorists, are deployed in Warmia-Masuria and Podlasie after warnings of possible sabotage. He called it preventive. rmf24.pl
A new count puts October's Black Sea ship attacks at eight. One report says at least eight merchant ships were hit off Romania and Bulgaria and four sank. It counts three sailors dead and 31 missing. wiadomosci.wp.pl
Moldova counted 19 airspace violations in October. Drones exploded on the ground in several districts and in four Transnistrian localities. Five of the blasts came on 3 October. moldpres.md

Analysis

High North and the Baltic Sea: the refrigeration attack is a new kind of target, the food chain. Reports name Sweden, Belgium, Luxembourg, Estonia, Ireland, the Netherlands and Finland. The EU called it deliberate. Finland's security service said a state actor cannot be ruled out, and Belgium opened a criminal investigation. Nobody has claimed it. The reports do not show who did it.

Poland: the Kaliningrad border operation is a precaution, not a response to an incident. Police say military intelligence and allied services warned of sabotage and possible armed crossings in the coming days. One report says GROM special forces were sent, and another says police are at full readiness from 2 to 8 Nov. No sabotage or crossing is reported.

Black Sea: the new report widens the picture beyond the Contship Jet, which sank on 28 October with all 18 crew rescued. It counts eight attacked ships in October. Bulgaria, Romania and Turkey held defence talks in Sofia. NATO is adding patrol aircraft, radar and drones. Separately, Romania scrambled F-16s and alerted Tulcea county as Ukraine's Danube ports were hit. No intrusion was reported.

Moldova and the Baltic states: Moldova's October tally shows drones reaching the ground in many districts, not only crossing. In Estonia, KAPO expelled a Russian citizen it says supplied Russian intelligence with information on the Russian-speaking minority. It is a counter-influence step, not an attack.