Summary
- An attempted arson attack targeted Starlink satellite communications equipment at Delska Lithuania's premises on 18 October.
- A security guard contained the fire before emergency crews arrived; antennas were not burned, but a control unit sustained minor damage.
- Authorities suspect sabotage, but no perpetrators or state involvement have been conclusively established.
Lithuanian authorities are investigating an attempted arson attack against Starlink communications equipment at premises operated by data centre provider Delska in Vilnius, following an incident that prompted the government to increase protection of critical infrastructure.
The attack occurred at approximately 02:00 on Sunday 18 October in the Aukštieji Paneriai district of the Lithuanian capital, where SpaceX uses leased premises for equipment supporting its Starlink satellite communications network.
Prime Minister Mindaugas Sinkevičius said incendiary liquids and Molotov cocktails were used in an attempt to set fire to the installation.
The apparent targets included nine satellite antennas and an associated control unit. A security guard detected the fire and began extinguishing it before emergency services arrived.
The prime minister reported that the antennas did not catch fire and that the control unit suffered minor fire damage.
Authorities have not reported a wider outage affecting Delska’s data centre services. Nor have they established that the incident caused a measurable interruption across the Starlink network.
The attack concerned equipment operated by SpaceX at a location associated with Delska Lithuania. It should not be interpreted as confirmation that the data centre’s computing rooms, electrical systems, or other customers were directly targeted.
Police have opened a criminal investigation and are searching for those responsible.
Physical security extends beyond server rooms
Data centre locations can host several categories of infrastructure, including servers, network equipment, telecommunications links, and installations operated by external customers.
The security arrangements for those assets depend on their location, ownership, physical accessibility, and operational requirements.
Satellite communications infrastructure may require antennas and other equipment outside conventional protected server rooms. Such installations can be exposed to different risks from the computing systems housed inside a secure building.
Damage to an antenna or associated control unit can affect communications services without involving a cyber intrusion or direct access to the underlying computer systems.
However, the operational consequences depend on the function of the affected equipment, the configuration of the network, and the availability of alternative facilities.
In the Vilnius incident, the limited damage reported by the government does not establish that Starlink experienced a service outage.
The rapid intervention by the security guard reduced the physical damage before the emergency response was complete.
Lithuania’s National Crisis Management Centre said the affected company had been warned about possible attacks in the preceding days, following similar incidents involving Starlink equipment elsewhere in Europe.
The warning was precautionary. The prime minister subsequently indicated that authorities had not possessed specific advance intelligence identifying the precise attack that took place.
Detection and physical response remain important components of infrastructure security, alongside controlled access, surveillance, incident escalation, and emergency service coordination.
Where several operators share premises, those procedures must account for equipment belonging to different organisations and the division of responsibilities under their commercial arrangements.
Neither the nature of Delska’s wider security systems nor the complete configuration of SpaceX’s installation has been disclosed publicly.
Suspected sabotage remains under investigation
Following a meeting of Lithuania’s National Security Commission on 19 October, the prime minister announced additional preparedness measures to protect infrastructure considered important to national security.
Officials are treating the attempted arson as suspected sabotage and have suggested a connection with attacks against Starlink facilities in Poland and Bulgaria.
Lithuanian authorities have raised the possibility of Russian involvement, citing concerns about interference with communications supporting Ukraine.
That remains an official assessment rather than a proven attribution. Investigators had not identified or detained the perpetrators when the latest information was released.
The National Crisis Management Centre has described the targeted installation as part of the operational Starlink network, which supports communications for civilian and commercial users as well as military applications.
Its specific role in any individual military communications arrangement has not been disclosed.
The Lithuanian investigation is therefore examining a physical attack against operational communications infrastructure, rather than an established compromise of software systems or information held by Delska.
The incident occurred on the same day as a separate drone entered Lithuanian airspace, prompting civil protection alerts and a security response.
Officials have discussed both events in the context of national preparedness, but no confirmed connection has been established between the drone incident and the attempted arson.
Resilience depends on shared infrastructure responsibilities
The case highlights the practical challenges of protecting critical communications equipment hosted at facilities supporting multiple services.
Where a site contains infrastructure operated by different organisations, the host must coordinate access and emergency arrangements with the owners of the equipment concerned.
Appropriate protection can vary considerably between a satellite antenna, an electricity transformer, a network termination system, and a computing hall.
The consequences of losing an individual asset also depend on redundancy. Multiple network paths or geographically separated installations may allow services to continue following localised damage, but that cannot be assumed without evidence of the system’s actual configuration.
Delska operates data centre infrastructure in Lithuania and Latvia. Available reporting does not establish that the company’s other facilities were targeted or affected.
The investigation will need to determine how the perpetrators approached the premises, whether the attempt formed part of a coordinated campaign, and whether additional protection is required at comparable installations.
For now, the confirmed outcome is an attempted attack, limited reported equipment damage, an active criminal investigation, and a government decision to strengthen critical infrastructure security.
