Hybrid Threats in Europe: What Citizens Should Prepare For

Hybrid Threats in Europe and Citizen Preparedness

Most people imagine that a national emergency begins with an unmistakable moment: a border is crossed, an alarm sounds or the government announces that the country is in crisis.

Modern disruption rarely follows such a clear sequence.

It may begin with a railway closure, an unexplained communications failure, suspicious drone activity, a cyberattack or conflicting information spreading online. Daily life continues, but some of the systems supporting it become unreliable.

Recent developments in Germany and along the Ukrainian-Polish border show how quickly that uncertainty can move closer to ordinary citizens.

A passenger train attacked near Poland

On 13 September 2026, a Russian drone struck the locomotive of a Ukrainian passenger train travelling towards Warsaw. The attack occurred approximately two kilometres from Poland, a member of NATO and the European Union.

Around 206 passengers and railway workers were reportedly on board. Nobody was injured because the crew received an advance warning and the train was evacuated.

A separate drone strike occurred even closer to Polish territory, near the Yahodyn Dorohusk border crossing. The incident happened approximately 800 metres from the border and forced the crossing to close temporarily.

Shortly before the attack, a diplomatic train carrying former British Prime Minister Boris Johnson, former Swedish Prime Minister Carl Bildt and European security advisers had travelled through the area. Another train reportedly carried former CIA director David Petraeus.

Ukraine’s railway operator suggested that the diplomatic train may have been the intended target. This has not been independently confirmed. What is known is that civilian transport was hit, a major border connection was disrupted and passengers had to depend on early warning and evacuation procedures. Associated Press

The attack did not cross into NATO territory. Its consequences still reached one of Europe’s borders.

Germany says it is facing hybrid attacks

Germany officially maintains that it is not at war. At the same time, its government acknowledges that the country is experiencing persistent hybrid threats.

These may include sabotage, cyberattacks, espionage, disinformation, interference with infrastructure and covert operations designed to remain below the threshold of conventional warfare.

On 9 September, Chancellor Friedrich Merz told the Bundestag that an attempted drone attack at Leipzig/Halle Airport had been prepared in Russia over an extended period and directed specifically against Germany. According to Merz, serious damage and possible casualties were narrowly avoided. Russia denies responsibility. Reuters

Following the attack on the Ukrainian train, German Defence Minister Boris Pistorius described the incident as a calculated escalation intended to frighten Europeans. He called for a calm response while making clear that Europe must retain the ability to defend itself. Reuters

This does not mean that Germany expects a conventional war to begin immediately. It reflects a security environment in which the boundary between peace, crisis and open conflict has become more difficult to define.

What is a hybrid threat?

A hybrid threat combines different methods to create pressure, instability or confusion without necessarily triggering a formal military response.

It may involve:

• Cyberattacks against public services or private companies.
• Sabotage of transport, energy or communications infrastructure.
• Drone activity near airports, military facilities or critical installations.
• Disinformation intended to create panic or distrust.
• Interference with supply chains or border operations.
• Espionage and covert influence operations.
• Physical attacks that remain geographically outside NATO territory but disrupt European systems.

For citizens, identifying who is responsible may be impossible in the first hours of an incident. The immediate concern is usually more practical: Is it safe to travel? Can family members be contacted? Is the information circulating online reliable? Will electricity, payments or mobile networks continue working?

Preparedness therefore cannot depend on knowing exactly what caused the disruption.

How hybrid incidents can affect ordinary households

Most families will never confront the strategic or military dimension of a hybrid conflict directly. They may still experience its secondary effects.

Transport disruption

Railways, airports, bridges, ports and border crossings are part of critical infrastructure. An attack or security alert affecting one location can create cancellations, delays and congestion far beyond the original incident.

Families should consider how they would return home if their normal route became unavailable. This is particularly important for people who commute across cities, depend on a single train line or regularly travel between countries.

An alternative route should not exist only inside a navigation application. Keeping a basic paper map or written route can help when the phone has no data connection or battery.

Communication failure

Mobile networks may become overloaded during a major emergency even when they have not been directly attacked. Calls often fail before text messages, while internet-based services may become unreliable or unavailable.

Every family should have:

• An agreed contact outside the immediate area.
• A physical meeting point near home.
• A second meeting point outside the neighbourhood.
• Important telephone numbers written on paper.
• A plan for collecting children if normal transport stops.
• A battery-powered or hand-crank radio.

The plan should be simple enough for children and older family members to follow without opening an application.

Conflicting information

Hybrid operations often seek to weaken trust. Real images may appear alongside old videos, false claims or speculation presented as confirmed information.

During an uncertain event, citizens should prioritise national and municipal authorities, emergency services and established news organisations. Screenshots without a visible source, anonymous voice messages and dramatic social-media posts should not guide evacuation or shelter decisions.

It is also important to check when a message was published. Accurate information from an earlier incident can become dangerous when shared as though it were current.

Disruption of connected devices

Homes increasingly depend on connected alarms, smart locks, cloud storage, payment applications, digital identification and location-sharing services.

The European Union’s Cyber Resilience Act is intended to improve the security of hardware and software sold in Europe. From 11 September 2026, manufacturers became responsible for reporting actively exploited vulnerabilities and severe security incidents affecting products with digital elements. European Commission

This strengthens consumer protection, but it does not make connected products immune to power, network or service failures.

No essential household function should depend entirely on one connected device. A physical key, printed contact list, cash reserve and offline copy of important information can preserve options when digital systems are unavailable.

Germany’s national warning test

On 10 September 2026, Germany tested its national warning system through the Bundesweiter Warntag.

Warnings were distributed using Cell Broadcast, radio, television, mobile applications and digital information panels. Municipalities supplemented these channels with sirens and, in some areas, vehicles equipped with loudspeakers.

This approach recognises that every communication channel has limitations.

A mobile alert may reach millions of people rapidly but still miss phones that are switched off, out of coverage or incompatible. Sirens can attract attention, but residents need to understand what their signals mean. Radio can provide instructions during an internet outage, but only to households that have an independent receiver.

Resilient warning does not come from finding one perfect technology. It comes from combining different channels and ensuring that citizens know how to respond.

What citizens can do now

Preparing for hybrid disruption does not mean preparing specifically for war. The same precautions are useful during blackouts, telecommunications failures, extreme weather, transport accidents and other emergencies.

Start with five decisions:

1. Decide how your family will communicate if calls and internet services fail.
2. Choose two physical meeting points.
3. Identify an alternative route home from work or school.
4. Keep essential contacts, instructions and documents available offline.
5. Follow official warning channels and understand the alert systems used where you live.

These preparations are inexpensive and do not require specialist equipment. Their value comes from making them before an emergency creates time pressure.

The role of municipalities

Household preparedness cannot replace functioning institutions.

Municipalities must ensure that residents know where official information will be available, especially if mobile networks and internet services fail. Physical information points, accessible instructions, multilingual communication and coordination with local organisations are essential.

Plans must also consider people who cannot use standard alerts because of hearing, visual, cognitive or mobility limitations.

A warning system succeeds only when the people receiving the message can understand it and act safely.

Preparation without fear

The proximity of an attack to a NATO border naturally generates concern. Responsible preparedness should not turn that concern into predictions of an inevitable war.

The more useful question is what households and communities can do when normal systems become temporarily unreliable.

A crisis may develop before governments agree on how to classify it. Transport can stop before the public understands why. Digital services can fail while authorities are still assessing what happened.

Preparedness provides time, alternatives and a clearer basis for making decisions during that uncertainty.

A crisis does not begin when a border is crossed. And resilience does not begin when the warning arrives.

It begins earlier, with a family that already knows how to communicate, where to meet and where to find trusted information.