Russian Drone and Missile Incursions into NATO Territory: The Running Record
A maintained ledger of Russian and Russia-attributed drone and missile incursions into NATO airspace since 2022, and how the alliance answered each one.
A maintained record of every dated Russian or Russia-attributed drone and missile incursion into NATO airspace since 2022, and how national forces, NATO command and governments answered each one — updated as new incidents occur.
Why this page exists
Since Russia's full-scale invasion, wreckage and live munitions from its air war on Ukraine have repeatedly crossed into NATO territory — Poland, Romania, Estonia, Latvia, Lithuania, Germany, Denmark, Bulgaria, Sweden's waters. Each incident tests the same three things in sequence: whether it can be detected, whether it can be safely and legally engaged, and whether any government decides it is worth raising with the alliance as a whole. Großwald has reported these incidents individually as they happened, in Signal and in dedicated pieces; this page holds the running record in one place rather than leaving it scattered across separate editions.
The pattern is the story, not any single incident. Through 2026 the authority to engage has moved from national capitals into NATO's own military chain faster than the political instrument for treating an incursion collectively — Article 4 consultation — has been used. This page tracks both curves side by side: what forces have quietly started doing when a drone or missile crosses a border, and what governments have stopped asking the alliance to discuss when one does.
State of play
Romania's escalation ladder
Romania supplies the most complete national record. A Russian drone first caused property damage on Romanian soil at Galați on 24–25 April 2026, four minutes inside national airspace, prompting the summons of Ambassador Vladimir Lipaev; Defence Minister Radu Miruță announced the Merops counter-drone system would be operational "within days" the same week. Five weeks later, on 29 May, a Geran-2 struck a Galați apartment block, injuring two civilians in the first drone-incursion casualties on NATO soil since 2022 — Romanian F-16s were airborne and cleared to fire but held, the track lasting only four minutes over populated ground.
The pattern reversed in late July. On 24 July a Romanian F-16 destroyed a Shahed-type drone over Buzău county on authority cleared through NATO's Combined Air Operations Centre at Torrejón, after two Italian Typhoons engaged and missed — 83 minutes from detection to kill, over empty ground. Two more shoot-downs followed on 25 and 26 July; a fourth target on 27 July crossed unengaged, with no reason given. Bucharest expelled a Russian diplomat and recalled its own ambassador the same day, citing prosecutors' forensic confirmation that recovered fragments were Russian.
Baltic Air Policing becomes an air-defence mission
For 22 years Baltic Air Policing was built for manned violations — intercept, identify, escort — with a shot assembled case by case above the cockpit. That changed by exception before it changed by mandate: a Romanian F-16 flying from Šiauliai downed a suspected Ukrainian drone over Estonia on 19 May 2026, the mission's first kinetic engagement since 2022, and a French Rafale did the same over Latvia near Bērzgale on 8 June, with Latvia's defence minister confirming NATO command took the decision.
At the Ankara summit on 7–8 July 2026 the mandate itself changed: allies converted Baltic Air Policing into an air defence mission, vesting engagement authority in the Supreme Allied Commander Europe and delegating it through the Combined Air Operations Centre at Uedem to the aircraft. Estonia's defence minister described the practical effect as removing "restrictions preventing the pilot from pressing the button." An Italian Eurofighter took the mission's third kill under the new mandate over Latvia's Balvi region on 14 August, after Russian electronic warfare pushed a drone off course.
The interior: airports, hinterland, and legal seams
Pressure has not stayed at the frontier. Between 22 and 28 September 2025 drones disrupted Danish airports and air bases around the Copenhagen EU summit, drawing an RAF counter-UAS detachment; on 3 October 2025 drones forced a temporary shutdown of Munich Airport. In February 2026 a Swedish naval vessel jammed a suspected Russian reconnaissance drone in the Øresund Strait 13 kilometres from the French carrier Charles de Gaulle, moored at Malmö — Stockholm's first documented probe of a NATO carrier in Baltic waters since accession.
Germany's turn came on the night of 4–5 August 2026, when an airport worker found a drone carrying an explosive device on the cargo apron at Leipzig/Halle, a NATO heavy-airlift and Ukrainian Antonov hub; the Federal Prosecutor General took the case on 6 August, alleging attempted causing of an explosion. No attribution, ambassadorial summons or alliance instrument has followed. German airports' own association confirms the promised counter-drone detection systems are still not fielded — "we are simply blind in the lower airspace," as one industry body put it.
The political cost and the Article 4 gap
Incursions have already cost one government its defence minister: after a Ukrainian-origin drone, redirected by Russian jamming, struck Latvia's Rēzekne oil depot on 7 May 2026, Prime Minister Evika Siliņa forced Andris Sprūds' resignation on 10 May, installing Colonel Raivis Melnis as the first uniformed officer to hold the portfolio. Poland has drawn the opposite lesson from its own precedent: after a Russian Kh-101 came down 100 kilometres inside the country near Tarnawa-Kolonia on 30 July 2026, Warsaw summoned Russia's ambassador and dated the missile's manufacture to within four months of impact, but did not invoke Article 4 — the instrument it used alone after September 2025's mass drone incursion.
That restraint is now the pattern across capitals. NATO's own North Atlantic Council said on 12 August that the flank violations show Russia's "increasing tolerance for risk" — a harder line than its September 2025 language, which had warned only of miscalculation — but no ally has requested consultations since. Großwald's Curated No. 49 traced the same finding across four separate national files in one week (Leipzig, a Bulgarian border incident at Kardam, Ceuta, and Poland) and found that available attribution did not, on its own, produce a request to treat any of them collectively.
Key numbers
| Metric | Value | As of | Source |
|---|---|---|---|
| Recorded drone incursions into Romanian airspace since 2022 | 33 (18 in 2026) | 29 Jul 2026 | Spanish Estado Mayor de la Defensa / Ejército del Aire, cited in Großwald's coverage of the Paznic detachment deployment |
| Drone incursions over European airports and military sites since Aug. 2024 | 144, "dozens" assessed Russia-likely | 5 Aug 2026 | IISS study, cited via the Financial Times in Großwald's Leipzig/Halle coverage |
| Baltic Air Policing kinetic engagements of foreign drones | 3, all since May 2026, in 22 years of the mission | 14 Aug 2026 | Estonia (19 May), Latvia/Bērzgale (8 June), Latvia/Balvi (14 August); NATO Baltic Air Policing |
| Romanian shoot-downs over four consecutive days | 3 of 4 targets engaged | 27 Jul 2026 | Romanian Ministry of National Defence, 24–27 July 2026 |
| Time since any ally last requested Article 4 consultations | Unused since 10 Sept. 2025 | 12 Aug 2026 | NATO / North Atlantic Council statement of 12 August 2026, tracked in Großwald Signal No. 122 |
| Production-to-impact interval on the Kh-101 recovered near Tarnawa-Kolonia | under 4 months | 31 Jul 2026 | Polish Ministry of National Defence, deputy minister Cezary Tomczyk |
| Merops interceptor unit cost / share of Shahed-type kills credited in Ukraine | ~$15,000 per round / ~40% | 24 Apr 2026 | NATO Allied Command Transformation, Eastern Phoenix exercise, Capu Midia |
| Confirmed breach count at the Galați apartment-block strike | 28th confirmed breach of Romanian airspace since 2022 | 29 May 2026 | Romanian Ministry of National Defence |
The ledger
Newest first. Each row is one dated development; the right-hand column links the Großwald piece that carried it. Rows without a link are recorded for continuity and sourced in the text.
| Date | What moved | Großwald |
|---|---|---|
| 16 Aug 2026 | A Spanish F-18 on NATO air policing from Mihail Kogălniceanu shoots down a drone that entered Romanian airspace from the Moldovan side about 24 km north of Galați (detected 04:44, engaged 05:01, probable impact between Baleni and Cudalbi in Galați county); the Romanian defence ministry says clearance ran through NATO's Combined Air Operations Centre at Torrejón — Romania's fourth shoot-down of the year, per the ministry. | — |
| 14 Aug 2026 | An Italian Eurofighter on Baltic Air Policing shoots down a drone over Latvia's Balvi region (Rugāji parish) after Russian electronic warfare pushes it off course — the mission's third kill since May. | Signal No. 124 |
| 12 Aug 2026 | NATO's North Atlantic Council calls the Polish and Romanian violations evidence of Russia's "increasing tolerance for risk"; no ally invokes Article 4. Germany separately logs drone flights over the Mechernich Patriot site and Belgium's Kleine-Brogel (B61 storage). | Signal No. 122 |
| 9 Aug 2026 | Großwald Curated No. 49 finds that across four separate national incident files in one week (Leipzig, Kardam, Ceuta, Poland), available attribution did not by itself produce a request to treat any incursion as a collective NATO or EU matter. | Curated No. 49 |
| 8 Aug 2026 | A drone crosses from Romanian into Bulgarian airspace undetected by either country's surveillance and explodes near the Kardam border crossing, roughly a kilometre from a Trans-Balkan gas pipeline compressor station; Sofia's preliminary reading is a stray Ukrainian Maya decoy, not deliberate. | Curated No. 49 |
| 6 Aug 2026 | Germany's Federal Prosecutor General takes over the Leipzig/Halle drone investigation, alleging attempted causing of an explosion; a police document and the interior ministry give conflicting accounts of whether an adjacent Ukrainian Antonov carried military ammunition. | Signal No. 118 · Leipzig drone case |
| 4 Aug 2026 | An airport bus driver finds a drone carrying an explosive device on the cargo apron at Leipzig/Halle airport, a NATO heavy-airlift and Ukrainian Antonov hub; flight operations halt for close to two hours and almost 20 DHL freighters are diverted. | Signal No. 117 · Leipzig drone case |
| 31 Jul 2026 | Poland dates the Kh-101 recovered near Tarnawa-Kolonia to second-quarter 2026 production near Moscow; the foreign ministry summons Russia's ambassador and hands over a protest note. Article 4 remains unused. | Signal No. 114 |
| 30 Jul 2026 | A Russian Kh-101 cruise missile comes down roughly 100 kilometres inside Poland near Tarnawa-Kolonia; a Polish F-16 tracks it but does not fire; military command says it stood ready to shoot had the missile continued flying. | Signal No. 113 · Kh-101 over Poland |
| 27 Jul 2026 | Romania expels a Russian diplomat and recalls its ambassador from Moscow after four drone incursions in four days; a fourth target crosses Romanian airspace toward Ukraine unengaged, with no reason given. | Signal No. 110 · Romania expels diplomat |
| 26 Jul 2026 | A third Romanian F-16 shoot-down in three days, over Romanian territorial waters near Sulina. | Curated No. 47 |
| 25 Jul 2026 | A second Romanian drone shoot-down near Sfântu Gheorghe, the day after the Buzău engagement. | Curated No. 47 |
| 24 Jul 2026 | A Romanian F-16 destroys a Shahed-type drone over Buzău county on authority cleared through NATO's Combined Air Operations Centre at Torrejón, after two Italian Typhoons engage and miss — 83 minutes from detection to kill, over uninhabited ground. | Signal No. 109 · Curated No. 47 |
| 8 Jul 2026 | NATO's Ankara summit converts Baltic Air Policing into an "air defence mission," vesting engagement authority in SACEUR and delegating it through the Combined Air Operations Centre at Uedem to the cockpit; Estonia's Ämari base is redesignated a NATO operational air base. | Signal No. 100 · Baltic Air Policing conversion |
| 8 Jun 2026 | A French Rafale on Baltic Air Policing shoots down a drone that crossed into Latvian airspace near Bērzgale; Latvia's defence minister says the engagement decision was taken by NATO command. | Signal No. 77 |
| 29 May 2026 | A Russian Geran-2 drone strikes an apartment block in Galați, injuring two civilians in the first drone-incursion casualties on NATO soil since 2022; Romanian F-16s were airborne and cleared to fire but the four-minute, low-altitude track over populated ground precluded engagement. | Signal No. 71 · Galați apartment strike |
| 19 May 2026 | A Romanian F-16 flying Baltic Air Policing from Šiauliai destroys a Ukrainian drone diverted by Russian electronic warfare over southern Estonia — the mission's first kinetic engagement of a foreign UAS since 2022. | Signal No. 63 · Romanian F-16 over Estonia |
| 10 May 2026 | Latvian Prime Minister Evika Siliņa forces Defence Minister Andris Sprūds' resignation over the government's response to the Rēzekne strike; Army Colonel Raivis Melnis is appointed, the first uniformed officer to hold the portfolio. | Sprūds resigns |
| 7 May 2026 | Two drones diverted by Russian electronic warfare enter Latvian airspace; one strikes the Rēzekne oil-storage depot, damaging four tanks. Military drone detection fails and public warnings are delayed roughly an hour. | Sprūds resigns |
| 25 Apr 2026 | A Russian drone causes the first property damage from drone action on Romanian territory at Galați, four minutes inside national airspace; roughly 200 residents are evacuated and Russia's ambassador is summoned. | Signal No. 47 · First Galați damage |
| 24 Apr 2026 | Romania tests the Merops counter-drone system at Capu Midia; Defence Minister Radu Miruță declares it operational "within days," covering the Danube corridor. | Signal No. 47 · First Galați damage |
| 25 Mar 2026 | Drones strike NATO territory in Estonia (the Auvere power station) and Latvia (the Kraslava region) on the same day, during a Russian barrage of over 550 drones and missiles against Ukraine; neither is intercepted. | Signal No. 24 |
| 25 Feb 2026 | A Swedish naval vessel jams a suspected Russian reconnaissance drone in the Øresund Strait roughly 13 kilometres from the French carrier Charles de Gaulle, moored at Malmö — the first documented probe of a NATO carrier in Baltic waters since Sweden's accession. | Øresund drone jamming |
| 11 Feb 2026 | NATO launches Arctic Sentry, led from Joint Force Command Norfolk, extending the enhanced-vigilance-activity template built for Baltic and Eastern Sentry to the High North. | Sentry triad |
| 3 Oct 2025 | Drones force a temporary shutdown of Munich Airport, with sightings also reported near the Erding military site, days after multiple drones were seen over critical infrastructure in Schleswig-Holstein. | NATO drone pressure |
| 22 Sep 2025 | A wave of drone disruptions hits Danish airports and air bases — Copenhagen, Billund, Aalborg, Esbjerg, Sønderborg, Skrydstrup, Karup — through 28 September, around the Copenhagen EU leaders' summit; Denmark requests an RAF counter-UAS detachment. | NATO drone pressure |
| 19 Sep 2025 | Three Russian MiG-31 fighters spend roughly 12 minutes in Estonian airspace; Estonia requests Article 4 consultations. | Sentry triad · Baltic Air Policing conversion |
| 12 Sep 2025 | NATO launches Eastern Sentry, an open-ended enhanced vigilance activity extending a collective operational frame over engagement decisions along the entire eastern flank. | Sentry triad |
| 10 Sep 2025 | At least 19 Russian drones cross into Polish airspace overnight during a strike wave against Ukraine; several are shot down. Poland requests Article 4 consultations — the last such request by any ally to date. | Sentry triad · Eastern Sentry |
| 14 Jan 2025 | NATO launches Baltic Sentry after the severing of the Estlink 2 power cable, setting the enhanced-vigilance-activity template later applied to Eastern and Arctic Sentry. | Sentry triad |
| 15 Nov 2022 | A missile kills two people at Przewodów, Poland; a Polish investigation later concludes it was a Ukrainian air-defence round rather than a deliberate Russian strike — the precedent Warsaw has invoked in 2026 for insisting on attribution before declaring intent. | Signal No. 113 |
The contrarian read
Reading these incidents as one coordinated Russian testing campaign overstates what the record shows. Each government's restraint has its own defensible, contemporaneous logic: Poland's insistence on forensic certainty before drawing conclusions rests directly on Przewodów, where a rushed attribution would have been wrong; Romania's non-engagements were track-length and public-safety judgments made by named officers in real time; Bulgaria's preliminary reading of the Kardam drone as a stray Ukrainian decoy, not a deliberate act, is the affected state's own assessment and may simply be correct; and Germany's federal prosecutor took the Leipzig case within three days precisely because a jurisdictional classification, unlike an attribution, commits Berlin to nothing it cannot support. Most Russian and Russian-adjacent drone activity reaching NATO territory is also demonstrably electronic-warfare spillover from Russia jamming Ukrainian drones aimed at Russia, not munitions aimed at NATO states — a mechanism repeatedly confirmed by Estonian, Latvian and Ukrainian officials rather than asserted. Four or five capitals reaching similar restrained conclusions in the same weeks may be five independent, individually sound judgments rather than a single alliance-wide pattern of accommodation — and treating consistency as proof of intent is the same inferential error this page's sources warn against making about Russia.
What to watch
The next Article 4 request
No ally has asked for consultations since Estonia and Poland both did within ten days of each other in September 2025. The next confirmed incursion serious enough to prompt a request — or the continued absence of one after the next Kh-101-class event — is the cleanest test of whether the restraint pattern Curated No. 49 identified is deliberate policy or coincidence.
A ground-based interceptor credited with a kill
Every drone downed over NATO territory in 2026 has been taken by a crewed fighter; the Merops system at Capu Midia has been operational since April without a credited engagement, and Spain's NH90 counter-drone helicopters arrived at Mihail Kogălniceanu in August on a four-month rotation. The observable is whether any engagement credits the cheaper layer before that rotation ends around December 2026.
The Lublin forensic report
Poland has not published the plant identification or production-date evidence behind its Kh-101 dating, and has not said whether the finding came from Polish forensics alone or with partner-intelligence input. Publication, or continued silence past the case's normal timeline, will show whether the claim was a shared alliance finding or a minister's unverified statement.
Flensburg's late-August interior-ministers meeting
Germany's interior minister hosts Baltic, Nordic and Polish counterparts on drone defence at the end of August 2026. Equipment and coordination announcements without any alliance instrument would extend the pattern of national-only responses; any move toward a shared mechanism would weaken it.
A named suspect or state attribution in the Leipzig case
The nearest precedent — the July 2024 incendiary-parcel plot at the same airport, attributed by Lithuanian investigators to Russian military intelligence — took two years to reach trial in Vilnius and has produced no German charge. Whether Germany's federal case moves faster, or confirms the same ceiling, is checkable against that base rate.
Related Großwald positions
External sources named in text: Reuters; NATO; Romanian Ministry of National Defence; Romanian Ministry of Foreign Affairs; Polish Ministry of Foreign Affairs; Estonian Ministry of Defence; Latvian Ministry of Defence; Generalbundesanwalt (Germany); Bundespolizei / Saxony state criminal police; IISS; Financial Times; ERR / LRT / BNS; Försvarsmakten (Sweden); Al Jazeera.
