An attribution made public six weeks after a fire
Romania's intelligence service, SRI, said on 26 October that a network coordinated from Russia caused a fire on a Brașov industrial platform on 14 September. Its statement places the fire immediately beside CARFIL SA, a state-owned arms maker's subsidiary. The public account does not establish damage to CARFIL's factory or an interruption of production. It is an official attribution to a particular incident, with the underlying intelligence still undisclosed.
Prosecutors have described a separate, continuing criminal inquiry. DIICOT says it identified three alleged participants and is seeking to bring them before Romanian courts. Its announced warrants and German detentions give the case a cross-border legal trail, yet they are procedural steps rather than a verdict on who lit the fire or directed it. Russia is the aggressor in its war against Ukraine. One suspect's Ukrainian nationality is no evidence that the Ukrainian state ordered an attack in Romania.
Key takeaways
- SRI attributes the 14 September fire beside CARFIL SA to a Russia-coordinated network. It has published its conclusion, not the intelligence or forensic file behind it.
- DIICOT identifies three suspects, reports two pre-trial detentions in Germany and a third warrant for a person located in Poland. No public conviction or final finding establishes their roles.
- The criminal test is whether admissible evidence links the fire to the suspects and traces instructions or support to coordinators in Russia. Diplomatic protest does not substitute for that proof.
What the agencies say happened at the site
DIICOT says the fire affected the premises of several businesses on the industrial platform. That leaves more than one set of damaged spaces to examine. Investigators must establish where ignition began and how each affected premise was damaged. An inspection record, emergency-response timeline and material samples could help answer those separate forensic questions. None of those case materials has been released publicly, so the fire's cause and damage pattern remain open to testing in court.
SRI says the alleged network received assignments against arms makers and other military-industrial sites in the region. It also alleges other attempted acts in Romania. The service has not named those incidents or released files that would let readers connect them to the Brașov fire. A claim about a wider network may guide investigators to common handlers, communications or payments. It cannot make every unexplained regional fire part of the same case.
Three suspects and two foreign jurisdictions
DIICOT's statement, reproduced by E-PEN, describes two Belarusian nationals and one Ukrainian national living in EU states. It says two suspects were found and held in pre-trial detention in Germany while allegedly preparing similar acts. Prosecutors issued a European arrest warrant on 26 October for a third person they located in Poland, and they are pursuing extradition to Romania. DIICOT has not publicly assigned each nationality to each arrest location. Pre-trial detention and an arrest warrant are not convictions.
The investigation began in September, according to DIICOT. Agerpres reports that prosecutors are examining attempted acts of subversion or sabotage as well as the fire. To prove the Brașov allegation, they would need to tie a suspect's conduct to the ignition and then show the claimed instruction chain. Travel or a photograph of a possible target alone would not establish either link. DIICOT has not released the full forensic, communications or financial record, so the public cannot yet inspect how investigators made those connections.
“DIICOT has not released the full forensic, communications or financial record, so the public cannot yet inspect how investigators made those connections.”
The diplomatic claim and the courtroom test
Romania's foreign ministry summoned Russia's ambassador on 27 October and lodged a protest. It said accumulated investigative evidence proved Russian responsibility. That gives the SRI attribution a diplomatic consequence, while the evidence itself remains outside the public record. AP reports that the Russian embassy denied the allegation and disputed whether evidence was presented to its ambassador. The embassy's denial is its claim, not an independent account of what caused the fire. The conflicting descriptions of the meeting cannot be resolved from the statements alone.
SRI also warns that recruiters can begin with paid surveillance or photographs arranged online before asking for more serious acts. That is a general security warning, not a disclosed recruitment history for the three Brașov suspects. Investigators could test it in this case through messages, payment records and testimony, subject to challenge in court. The distinction protects the value of the service's warning: a person doing a small paid task is not automatically a saboteur, and a suspected operative's passport does not identify the state that gave instructions.
Romania has publicly established that SRI attributes the 14 September fire beside CARFIL SA to Russian coordination and that DIICOT is pursuing three suspects through German and Polish procedures. The criminal case still has to prove the fire's cause, each defendant's conduct and any link from them to handlers in Russia. Extradition, a tested forensic account and admissible communications or payment evidence examined by a Romanian court would change the assessment from official attribution and allegation to a judicial finding. Until then, neither a warrant nor an embassy denial settles that chain.



