Russian Drone and Missile Incursions into NATO Territory: The Running Record
A maintained ledger of Russian and Russia-attributed drone and missile incursions into NATO airspace since 2022, and how the alliance answered each one.
A maintained record of every dated Russian or Russia-attributed drone and missile incursion into NATO airspace since 2022, and how national forces, NATO command and governments answered each one — updated as new incidents occur.
Why this page exists
Since Russia's full-scale invasion, wreckage and live munitions from its air war on Ukraine have repeatedly crossed into NATO territory — Poland, Romania, Estonia, Latvia, Lithuania, Germany, Denmark, Bulgaria, Sweden's waters. Each incident tests the same three things in sequence: whether it can be detected, whether it can be safely and legally engaged, and whether any government decides it is worth raising with the alliance as a whole. Read in sequence, the incidents show how far detection, engagement rules and political response have each moved since 2022 — and where the gaps between them remain.
The pattern is the story, not any single incident. Through 2026 the authority to engage has moved from national capitals into NATO's own military chain faster than the political instrument for treating an incursion collectively — Article 4 consultation — has been used. This page tracks both curves side by side: what forces have quietly started doing when a drone or missile crosses a border, and what governments have stopped asking the alliance to discuss when one does.
State of play
Romania's escalation ladder
Romania supplies the most complete national record. A Russian drone damaged property at Galați on 24–25 April 2026 — no earlier property damage from a drone on Romanian territory is recorded — after four minutes inside national airspace, prompting the summons of Ambassador Vladimir Lipaev; Defence Minister Radu Miruță announced the Merops counter-drone system would be operational "within days" the same week. Five weeks later, on 29 May, a Geran-2 struck a Galați apartment block, injuring two civilians; no earlier civilian casualties from a drone incursion on NATO territory are recorded since 2022 — Romanian F-16s were airborne and cleared to fire but held, the track lasting only four minutes over populated ground.
The pattern reversed in late July. On 24 July a Romanian F-16 destroyed a Shahed-type drone over Buzău county on authority cleared through NATO's Combined Air Operations Centre at Torrejón, after two Italian Typhoons engaged and missed — 83 minutes from detection to kill, over empty ground. Two more shoot-downs followed on 25 and 26 July; a fourth target on 27 July crossed unengaged, with no reason given. Bucharest expelled a Russian diplomat and recalled its own ambassador the same day, citing prosecutors' forensic confirmation that recovered fragments were Russian.
Baltic Air Policing becomes an air-defence mission
For 22 years Baltic Air Policing was built for manned violations — intercept, identify, escort — with engagement authority held above the cockpit and granted case by case. That changed by exception before it changed by mandate: a Romanian F-16 flying from Šiauliai downed a suspected Ukrainian drone over Estonia on 19 May 2026 — no earlier kinetic engagement by the mission is recorded — and a French Rafale did the same over Latvia near Bērzgale on 8 June, with Latvia's defence minister confirming NATO command took the decision.
At the Ankara summit on 7–8 July 2026 the mandate itself changed: allies converted Baltic Air Policing into an air defence mission, vesting engagement authority in the Supreme Allied Commander Europe and delegating it through the Combined Air Operations Centre at Uedem to the aircraft. Estonia's defence minister described the practical effect as removing "restrictions preventing the pilot from pressing the button." An Italian Eurofighter took the mission's third kill overall, and its first under the new mandate, over Latvia's Balvi region on 14 August, after Russian electronic warfare pushed a drone off course.
The interior: airports, hinterland, and legal seams
Pressure has not stayed at the frontier. Between 22 and 28 September 2025 drones disrupted Danish airports and air bases around the Copenhagen EU summit, drawing an RAF counter-UAS detachment; on 3 October 2025 drones forced a temporary shutdown of Munich Airport. In February 2026 a Swedish naval vessel jammed a suspected Russian reconnaissance drone in the Øresund Strait 13 kilometres from the French carrier Charles de Gaulle, moored at Malmö; no earlier documented drone probe of a NATO carrier in Baltic waters since Sweden's 2024 accession is recorded.
Germany's turn came on the night of 4–5 August 2026, when an airport worker found a drone carrying an explosive device on the cargo apron at Leipzig/Halle, a NATO heavy-airlift and Ukrainian Antonov hub; the Federal Prosecutor General took the case on 6 August, alleging attempted causing of an explosion. No attribution, ambassadorial summons or alliance instrument has followed. German airports' own association confirms the promised counter-drone detection systems are still not fielded — "we are simply blind in the lower airspace," as one industry body put it.
The political cost and the Article 4 gap
Incursions have already cost one government its defence minister: after a Ukrainian-origin drone, redirected by Russian jamming, struck Latvia's Rēzekne oil depot on 7 May 2026, Prime Minister Evika Siliņa forced Andris Sprūds' resignation on 10 May, installing Colonel Raivis Melnis, a serving officer, in a portfolio previously held by civilians. Poland has drawn the opposite lesson from its own precedent: after a Russian Kh-101 came down 100 kilometres inside the country near Tarnawa-Kolonia on 30 July 2026, Warsaw summoned Russia's ambassador and dated the missile's manufacture to within four months of impact, but did not invoke Article 4 — the instrument it invoked on 10 September 2025 after the mass drone incursion, nine days before Estonia did the same over a MiG-31 violation.
That restraint is now the pattern across capitals. NATO's own North Atlantic Council said on 12 August that the flank violations show Russia's "increasing tolerance for risk" — a harder line than its September 2025 language, which had warned only of miscalculation — but no ally has requested consultations since. Across four separate national cases in one week in early August (Leipzig, a Bulgarian border incident at Kardam, Ceuta, and Poland), available attribution did not, on its own, produce a request to treat any of them collectively.
Key numbers
| Metric | Value | As of | Source |
|---|---|---|---|
| Drone violations of Romanian airspace in 2026 | at least 23 (against 18 across 2022–2025) | 21 Aug 2026 | Romanian Ministry of National Defence figures reported by ABC News, 21 August 2026; an earlier Spanish Estado Mayor de la Defensa count gave 33 since 2022, 18 of them in 2026, as of 29 July |
| Drone incursions over European airports and military sites since Aug. 2024 | 144, "dozens" assessed Russia-likely | 5 Aug 2026 | IISS study, as reported by the Financial Times, August 2026 |
| Baltic Air Policing kinetic engagements of foreign drones | 3, all since May 2026, in 22 years of the mission | 20 Aug 2026 | Estonia (19 May), Latvia/Bērzgale (8 June), Latvia/Balvi (14 August — identified on 20 August as Ukrainian, entered from Belarus, likely diverted by Russian jamming); NATO Baltic Air Policing / Latvian armed forces |
| Romanian shoot-downs over four consecutive days | 3 of 4 targets engaged | 27 Jul 2026 | Romanian Ministry of National Defence, 24–27 July 2026 |
| Time since any ally last requested Article 4 consultations | Unused since 19 Sept. 2025 (Estonia; Poland's request came 10 Sept.) | 12 Aug 2026 | NATO / North Atlantic Council statement of 12 August 2026; Estonian government decision of 19 September 2025; see Signal No. 122 |
| Production-to-impact interval on the Kh-101 recovered near Tarnawa-Kolonia | under 4 months | 31 Jul 2026 | Polish Ministry of National Defence, deputy minister Cezary Tomczyk |
| Merops interceptor unit cost / share of Shahed-type kills credited in Ukraine | ~$15,000 per round / ~40% | 24 Apr 2026 | NATO Allied Command Transformation, Eastern Phoenix exercise, Capu Midia |
| Confirmed breach count at the Galați apartment-block strike | 28th confirmed breach of Romanian airspace since 2022 | 29 May 2026 | Romanian Ministry of National Defence |
The ledger
Newest first, one dated development per entry; where a Großwald piece covers it, the entry links to it.
Romanian F-16s destroy an explosive-laden sea drone reported drifting a few hundred metres from the Neptun Deep gas works in Romania's exclusive economic zone, about 80 nautical miles east of Constanța, with cannon fire after a defence-ministry command cell requested that NATO-level command be assumed by the Romanian Armed Forces; Defence Minister Radu Miruță says Kyiv, contacted through an established channel, confirmed the device was not Ukrainian, and President Nicușor Dan names Russia. A maritime rather than airspace incursion; the response ran national, despite the July extension of the Romanian–Bulgarian–Turkish task force to infrastructure protection.
Hours earlier, during the same night's barrage on Kyiv, an aerial drone enters Romanian airspace about 13 km east of Galați — radar picks up a group of aerial assets near the Ukrainian border at 02:23 — and crashes and burns four kilometres north-east of Grindu, Tulcea County, at 03:24 in an uninhabited area; two Spanish F-18s and an IAR-330 helicopter are scrambled to track it, no engagement, no casualties.
Latvia's armed forces identify the drone an Italian Eurofighter shot down over Balvi on 14 August as Ukrainian: it entered from Belarus, most likely diverted by Russian electronic-warfare interference during Ukrainian attacks on Russian ports that night — attribution arriving six days after an engagement taken under the delegated NATO chain, which did not depend on origin.
A Spanish F-18 on NATO air policing from Mihail Kogălniceanu shoots down a drone that entered Romanian airspace from the Moldovan side about 24 km north of Galați (detected 04:44, engaged 05:01, probable impact between Baleni and Cudalbi in Galați county); the Romanian defence ministry says clearance ran through NATO's Combined Air Operations Centre at Torrejón — Romania's fourth shoot-down of the year, per the ministry.
An Italian Eurofighter on Baltic Air Policing shoots down a drone over Latvia's Balvi region (Rugāji parish) after Russian electronic warfare pushes it off course — the mission's third kill since May.
NATO's North Atlantic Council calls the Polish and Romanian violations evidence of Russia's "increasing tolerance for risk"; no ally invokes Article 4. Germany separately logs drone flights over the Mechernich Patriot site and Belgium's Kleine-Brogel (B61 storage).
A drone crosses from Romanian into Bulgarian airspace undetected by either country's surveillance and explodes near the Kardam border crossing, roughly a kilometre from a Trans-Balkan gas pipeline compressor station; Sofia's preliminary reading is a stray Ukrainian Maya decoy, not deliberate.
Germany's Federal Prosecutor General takes over the Leipzig/Halle drone investigation, alleging attempted causing of an explosion; a police document and the interior ministry give conflicting accounts of whether an adjacent Ukrainian Antonov carried military ammunition.
An airport bus driver finds a drone carrying an explosive device on the cargo apron at Leipzig/Halle airport, a NATO heavy-airlift and Ukrainian Antonov hub; flight operations halt for close to two hours and almost 20 DHL freighters are diverted.
Poland dates the Kh-101 recovered near Tarnawa-Kolonia to second-quarter 2026 production near Moscow; the foreign ministry summons Russia's ambassador and hands over a protest note. Article 4 remains unused.
A Russian Kh-101 cruise missile comes down roughly 100 kilometres inside Poland near Tarnawa-Kolonia; a Polish F-16 tracks it but does not fire; military command says it stood ready to shoot had the missile continued flying.
Romania expels a Russian diplomat and recalls its ambassador from Moscow after four drone incursions in four days; a fourth target crosses Romanian airspace toward Ukraine unengaged, with no reason given.
A third Romanian F-16 shoot-down in three days, over Romanian territorial waters near Sulina.
A second Romanian drone shoot-down near Sfântu Gheorghe, the day after the Buzău engagement.
A Romanian F-16 destroys a Shahed-type drone over Buzău county on authority cleared through NATO's Combined Air Operations Centre at Torrejón, after two Italian Typhoons engage and miss — 83 minutes from detection to kill, over uninhabited ground.
NATO's Ankara summit converts Baltic Air Policing into an "air defence mission," vesting engagement authority in SACEUR and delegating it through the Combined Air Operations Centre at Uedem to the cockpit; Estonia's Ämari base is redesignated a NATO operational air base.
A French Rafale on Baltic Air Policing shoots down a drone that crossed into Latvian airspace near Bērzgale; Latvia's defence minister says the engagement decision was taken by NATO command.
A Russian Geran-2 drone strikes an apartment block in Galați, injuring two civilians — no earlier civilian casualties from a drone incursion on NATO territory are recorded since 2022; Romanian F-16s were airborne and cleared to fire but the four-minute, low-altitude track over populated ground precluded engagement.
A Romanian F-16 flying Baltic Air Policing from Šiauliai destroys a Ukrainian drone diverted by Russian electronic warfare over southern Estonia — no earlier kinetic engagement of a foreign UAS by the mission is recorded.
Latvian Prime Minister Evika Siliņa forces Defence Minister Andris Sprūds' resignation over the government's response to the Rēzekne strike; Army Colonel Raivis Melnis a serving officer, is appointed to a portfolio previously held by civilians.
Two drones diverted by Russian electronic warfare enter Latvian airspace; one strikes the Rēzekne oil-storage depot, damaging four tanks. Military drone detection fails and public warnings are delayed roughly an hour.
A Russian drone damages property at Galați — no earlier property damage from drone action on Romanian territory is recorded — four minutes inside national airspace; roughly 200 residents are evacuated and Russia's ambassador is summoned.
Romania tests the Merops counter-drone system at Capu Midia; Defence Minister Radu Miruță declares it operational "within days," covering the Danube corridor.
Drones strike NATO territory in Estonia (the Auvere power station) and Latvia (the Kraslava region) on the same day, during a Russian barrage of over 550 drones and missiles against Ukraine; neither is intercepted.
A Swedish naval vessel jams a suspected Russian reconnaissance drone in the Øresund Strait roughly 13 kilometres from the French carrier Charles de Gaulle, moored at Malmö; no earlier documented drone probe of a NATO carrier in Baltic waters since Sweden's 2024 accession is recorded.
NATO launches Arctic Sentry, led from Joint Force Command Norfolk, extending the enhanced-vigilance-activity template built for Baltic and Eastern Sentry to the High North.
Drones force a temporary shutdown of Munich Airport, with sightings also reported near the Erding military site, days after multiple drones were seen over critical infrastructure in Schleswig-Holstein.
A wave of drone disruptions hits Danish airports and air bases — Copenhagen, Billund, Aalborg, Esbjerg, Sønderborg, Skrydstrup, Karup — through 28 September, around the Copenhagen EU leaders' summit; Denmark requests an RAF counter-UAS detachment.
Three Russian MiG-31 fighters spend roughly 12 minutes in Estonian airspace; Estonia requests Article 4 consultations.
NATO launches Eastern Sentry, an open-ended enhanced vigilance activity extending a collective operational frame over engagement decisions along the entire eastern flank.
At least 19 Russian drones cross into Polish airspace overnight during a strike wave against Ukraine; several are shot down. Poland requests Article 4 consultations; Estonia follows on 19 September, and no ally has requested consultations since.
NATO launches Baltic Sentry after the severing of the Estlink 2 power cable, setting the enhanced-vigilance-activity template later applied to Eastern and Arctic Sentry.
A missile kills two people at Przewodów, Poland; a Polish investigation later concludes it was a Ukrainian air-defence round rather than a deliberate Russian strike — the precedent Warsaw has invoked in 2026 for insisting on attribution before declaring intent.
The contrarian read
Reading these incidents as one coordinated Russian testing campaign overstates what the record shows. Each government's restraint has its own defensible, contemporaneous logic: Poland's insistence on forensic certainty before drawing conclusions rests directly on Przewodów, where a rushed attribution would have been wrong; Romania's non-engagements were track-length and public-safety judgments made by named officers in real time; Bulgaria's preliminary reading of the Kardam drone as a stray Ukrainian decoy, not a deliberate act, is the affected state's own assessment and may simply be correct; and Germany's federal prosecutor took the Leipzig case within three days precisely because a jurisdictional classification, unlike an attribution, commits Berlin to nothing it cannot support. Most Russian and Russian-adjacent drone activity reaching NATO territory is also demonstrably electronic-warfare spillover from Russia jamming Ukrainian drones aimed at Russia, not munitions aimed at NATO states — a mechanism repeatedly confirmed by Estonian, Latvian and Ukrainian officials rather than asserted. Four capitals reaching similar restrained conclusions in the same weeks may be four independent, individually sound judgments rather than a single alliance-wide pattern of accommodation; treating consistency as proof of intent is an inference the record does not support.
What to watch
The next Article 4 request
No ally has asked for consultations since Poland (10 September) and Estonia (19 September) did in 2025. Finland answered the 20 August Il-20 violation — a crewed aircraft, which removes the attribution problem the drone cases carried — with a summons and a note, not a request. The next incursion serious enough to prompt one, or the continued absence of one after the next Kh-101-class event, is the cleanest test of whether the pattern of national-only responses is deliberate policy or coincidence.
A ground-based interceptor credited with a kill
Every drone downed over or off NATO territory in 2026 has been taken by a crewed fighter — the 20 August Neptun Deep sea drone by F-16 cannon; the Merops system at Capu Midia has been operational since April without a credited engagement in Romania (its ~40 per cent kill share is a Ukrainian figure), and Spain's NH90 counter-drone helicopters arrived at Mihail Kogălniceanu in August on a four-month rotation. What to watch for is whether any engagement credits the cheaper layer before that rotation ends around December 2026.
The Lublin forensic report
Poland has not published the plant identification or production-date evidence behind its Kh-101 dating, and has not said whether the finding came from Polish forensics alone or with partner-intelligence input. Publication, or continued silence past the case's normal timeline, will show whether the claim was a shared alliance finding or a minister's unverified statement.
Flensburg's late-August interior-ministers meeting
Germany's interior minister Alexander Dobrindt hosts counterparts from the Baltic states, Poland, Sweden, Norway and Denmark on drone defence at the Mürwik naval academy in Flensburg at the end of August 2026, billed as coordinating a common counter-UAS strategy and critical-infrastructure protection. Equipment and coordination announcements without any alliance instrument would extend the pattern of national-only responses; any move toward a shared mechanism would weaken it.
A named suspect or state attribution in the Leipzig case
The nearest precedent — the July 2024 incendiary-parcel plot at the same airport, attributed by Lithuanian investigators to Russian military intelligence — took two years to reach trial in Vilnius and has produced no German charge. Whether Germany's federal case moves faster, or confirms the same ceiling, can be tested against that base rate.
Neptun Deep and the trilateral task force
Romania, Bulgaria and Turkey agreed in July to extend their Black Sea mine-clearing task force to protecting critical infrastructure, yet the 20 August sea-drone engagement ran national after a Romanian command cell asked for NATO-level command to be assumed by Romanian forces. Whether the task force takes up station around Neptun Deep before first gas in 2027, and whether platform protection appears in allied tasking or stays a national arrangement, can be tested.
Related Großwald positions
Scope: dated Russian or Russia-attributed drone and missile incursions into NATO airspace since 2022 and the response to each — national forces, NATO command, governments. Crewed-aircraft airspace violations and Moldovan incidents are noted where relevant but tracked elsewhere. Each entry is sourced to the defence ministry or command that reported it; attribution is recorded as stated by that authority.
External sources named in text: Reuters; NATO; Romanian Ministry of National Defence; Romanian Ministry of Foreign Affairs; Polish Ministry of Foreign Affairs; Estonian Ministry of Defence; Latvian Ministry of Defence; Generalbundesanwalt (Germany); Bundespolizei / Saxony state criminal police; IISS; Financial Times; ERR / LRT / BNS; Försvarsmakten (Sweden); Al Jazeera; ABC News.
