France and Germany are summoning their respective Russian ambassadors, and the European Union together with the United Kingdom has imposed a coordinated package of sanctions, in response to what Western capitals describe as a sustained Russian cyber-espionage and sabotage campaign. French Foreign Minister Jean-Noël Barrot announced on Monday that Paris would summon the Russian envoy in the coming days and sanction nine individuals and four entities linked to the Federal Security Service (FSB). Germany’s foreign ministry confirmed it had already summoned the Russian ambassador in Berlin, stating that cyberattacks against Germany, EU partners and Ukraine were unacceptable and would be met with additional sanctions.

According to French and German officials, the cyber operations targeted government ministries, defence contractors and critical infrastructure across at least nine European countries, including an attempt to disrupt Poland’s power grid that could have left half a million citizens without electricity in winter. The EU and UK jointly designated 24 individuals and entities, among them officers of the GRU military intelligence service and the FSB’s Centre 16, a unit Western intelligence agencies have long linked to the Turla hacking group. London also sanctioned Rybar LLC, a media company it says is resourced by the Russian state to spread disinformation and interfere in European elections. Moscow, through its foreign ministry and President Vladimir Putin, has repeatedly dismissed such allegations as baseless and part of a Western campaign to justify aggressive policies.

The sanctions freeze assets and impose travel bans on designated individuals and entities. The UK’s National Crime Agency reported that the Lumma Stealer malware, used by Russian cybercriminals to harvest credentials, had compromised at least 2,100 victims in Britain in the past six months. The EU’s statement noted that the FSB’s 16th Centre has conducted cyber espionage against French governmental entities since 2010 and against German targets, while also carrying out disruptive sabotage operations against Polish critical infrastructure. The coordinated action marks the first time the EU and UK have imposed joint cyber sanctions, signalling a deepening of post-Brexit security cooperation.

The diplomatic démarches are the latest in a series of tit-for-tat expulsions and summonings between Russia and European capitals. In 2024, Germany summoned the Russian ambassador over a hack of the Social Democratic Party, and Russia expelled German journalists. The EU is simultaneously preparing a 21st package of sanctions against Moscow over the war in Ukraine, with the bloc’s foreign policy chief indicating that additional names may be added. The Russian ambassador to France is expected to be summoned in the coming days, while Berlin has already delivered its protest. The dossier remains open as both sides continue to trade accusations of hybrid warfare.