The Digital Battlefield: How Poland Fought a Two-Front War After the Kraków Attack

The afternoon of November 7, 2026, should have been just another Saturday in Kraków’s historic Main Market Square, a place where centuries of Polish history echo through cobblestone streets and where tourists and locals alike gather to soak in the atmosphere of one of Europe’s most beautiful cities. Instead, it became a scene of unimaginable violence and, within hours, the opening salvo of a different kind of war entirely. Six people lay dead, sixteen more were wounded, and the suspect—a 24-year-old Polish man named Michał O. who police would later describe as “ultra-nationalist” with deeply radical far-right views—had been shot and captured after a confrontation with police. Later that evening, investigators made an even more harrowing discovery: the bodies of the shooter’s own father, mother, and sister at the family apartment in Ostrowiec Świętokrzyski, some 100 miles northeast of the city. The tragedy was devastating enough on its own terms, but what happened in the hours that followed revealed something equally disturbing about the world we now live in—a parallel assault unfolding not on the streets of Kraków, but in the vast, chaotic information space that connects billions of people through their screens.

Within three hours of the first shots, a coordinated disinformation campaign was already in full swing, and its scale was staggering. AI-sharpened images, fabricated videos, and carefully crafted false narratives about the shooter flooded social media platforms simultaneously in four different languages—Polish, English, French, and Dutch. By 6:00 PM local time, just hours after the attack began, disinformation content had accumulated more than 200 million views across various platforms. More than 2,000 accounts were flagged for moderation, many of them automated bots posting identical or nearly identical content in rapid succession, a pattern that experts say indicates professional-scale automation infrastructure rather than organic sharing. Among the most viral and damaging falsehoods was a claim that the attacker was a Ukrainian army mercenary—a story that investigative journalists would eventually trace to a Kremlin-linked Telegram channel, but not before it had spread across borders and been amplified by state media outlets in Belarus and beyond.

The Polish government’s response was swift and dramatic, reflecting both the seriousness of the threat and the institutional knowledge that had been built up over years of dealing with Russian information warfare. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski convened an extraordinary overnight crisis session, bringing together his deputy ministers and senior specialists from the Center for Countering Disinformation, known by its Polish acronym OPD. The center was placed into full “crisis-mode” monitoring, with analysts working in real time to track and analyze publications related to the attack. Gawkowski issued a public warning that AI-altered and AI-sharpened images from the attack scene were circulating and should not be reshared—a warning that reflected a particularly insidious aspect of modern disinformation. The technology to enhance blurry, low-resolution footage from chaotic scenes has become so sophisticated that artificially crisped images now look more credible to ordinary viewers than the raw, grainy footage that would naturally emerge from such an event. This was not Gawkowski’s first warning of this kind; just a month earlier, he had publicly accused social media platforms of being a “silent ally of Russian bots and the Kremlin’s GRU,” threatening EU-level financial penalties for companies that ignored Poland’s automated takedown requests. Saturday’s information wave was, in effect, the exact scenario he had been warning about.

The technical analysis conducted by Poland’s NASK Disinformation Analysis Center revealed the sophisticated machinery behind the attack. Analysts identified a telltale fingerprint in a subset of the flagged accounts: Cyrillic-character artifacts embedded in otherwise Polish-language posts—a classic localization failure in automated content farms when operators fail to fully scrub character encoding from templates built in Russian. The disinformation itself coalesced around five main narrative clusters, each designed to exploit different fault lines in Polish society and politics. The most viral narrative, reaching up to 200 million views, claimed the entire attack was orchestrated by the government with EU involvement. Another narrative, with 5.6 million views, suggested the attack was “staged” to cancel Poland’s Independence March scheduled for November 11, just four days away. A third narrative, which gained 14 million views, tried to link the attack to an unrelated political crisis over the Constitutional Tribunal that was dominating domestic headlines. A fourth narrative claimed, based on his clothing, that the shooter was a soldier, while the fifth—the Ukrainian army mercenary story—was specifically designed to inflame tensions between Poland and Ukraine, two nations that have been close allies since Russia’s invasion of Ukraine in 2022. Officials were also forced to actively correct two specific false reports that spread during the initial confusion: that a police officer had been killed, and that police had been absent from the square when the shooting began.

The investigation into the Ukrainian mercenary narrative provided a particularly revealing case study in how modern disinformation campaigns operate across borders. Investigative outlet OKO.press traced the falsehood to the Telegram channel Shot, owned by a Kremlin-linked Russian media group operating within the milblogger ecosystem that has been producing tactical disinformation since 2022. The channel’s post alleged the suspect wore a patch from Ukraine’s Azov Brigade, citing a photo circulating on social media. However, analysts quickly identified the patch as a generic “Blackbeard” design commercially available from multiple online retailers—not a military unit insignia at all. Despite this debunking, the narrative spread anyway, amplified by Belarusian state media and picked up by outlets in several other countries before eventually fading once Polish security services publicly confirmed the attacker’s Polish nationality and far-right domestic profile. What makes this particularly troubling is the cross-border amplification pattern it revealed: a narrative seeded on a Telegram channel, legitimized by state broadcasters, then dispersed through automated multilingual bot networks to reach Western social media audiences. Polish officials, including the Special Services coordinator, said military intelligence is examining disinformation originating outside Poland, but they carefully stopped short of formal state attribution, describing foreign amplification as a suspicion under investigation rather than a confirmed finding. Notably, CyberDefence24 also noted that the available evidence does not support concluding the entire disinformation wave was a single, centrally coordinated operation—the domestic far-right played its own active role in amplifying false narratives.

The domestic dimension of the disinformation campaign added another layer of complexity to an already fraught situation. Polish MEP Ewa Zajączkowska attacked Interior Minister Kierwiński over his characterization of the suspect’s far-right links, while Sejm member Anita Czerwińska suggested a connection between the attacker and LGBT advocacy groups, explicitly pushing back against the government’s emphasis on far-right ideology. Romanian far-right politician George Simion amplified a claim that the suspect held “extreme left-wing” beliefs—the exact inverse of what Polish police and the Interior Minister had stated. Prime Minister Donald Tusk, meanwhile, publicly urged all politicians not to exploit the tragedy, a plea that seemed almost naive given the speed with which political actors on both sides moved to weaponize the attack for their own purposes. In parallel with the counter-disinformation response, law enforcement launched a digital investigation of the shooter himself, with the Central Bureau for Combating Cybercrime examining his online activity, the content he published, the groups he participated in, and whether he held membership in networks of individuals with radical views. Investigators are also examining whether warning signals existed in his digital footprint that could have been detected before the attack—a question that has become increasingly urgent as researchers document the radicalization pathways that lead individuals from online extremism to real-world violence.

The events of November 7 crystallize a structural problem that Poland’s digital authorities have been documenting for years, and that the EU’s Digital Services Act has so far failed to solve. The DSA’s Very Large Online Platforms framework requires platforms to have robust systems for receiving and acting on “trusted flagger” notifications, and Poland’s NASK operates as exactly such a trusted flagger. Yet in the first half of 2026 alone, NASK submitted more than 65,000 notifications to social media companies, and platforms acted on fewer than 7 percent of them. This is not a reporting failure—NASK is flagging at scale. It is an enforcement failure. The DSA creates a notification architecture without a mandatory response-time requirement, and without meaningful penalties for inaction at the speed that crisis disinformation demands. Saturday’s outcome was the predictable consequence: within approximately three hours of the Kraków attack, disinformation had reached 200 million views, while the platform notification system was processing requests at the same pace it always does—far slower than the speed of viral amplification. Polish officials are pointing at the evidence trail—a Kremlin-linked Telegram channel, Belarusian state television, bot accounts leaving Cyrillic fingerprints—while carefully declining to call it a confirmed state operation. The Center for Countering Disinformation remains in crisis mode, and Deputy Prime Minister Gawkowski has indicated Poland will push for stricter platform accountability at the EU level. The events of November 7 provide the clearest data point yet for that argument, but they also raise a troubling question that no amount of institutional preparation can fully answer: in an information environment where lies can reach 200 million people in three hours, how can any system of verification and correction ever hope to keep pace? Poland, which has spent years building one of Europe’s most sophisticated counter-disinformation infrastructures, has institutionalized its response posture to a remarkable degree. But what Saturday’s attack made brutally clear is that the hardest problem in information-operations work is not detecting disinformation—it is reaching audiences who have already seen the false content before the damage is done.