The risk

How this actually happens, where it's happened before, and who we think is behind it.

01 — Why

Who we think is behind it, and why we think it gets worse before it gets better.

Putin can't simply stop. Two decades of a mafia state run by the oligarchy mean a real climb-down puts Putin's life in danger, not just a policy setback — and Western pressure since 2022 has closed off any face-saving way to just walk away either. Unable to retreat, unable to afford to lose — the pressure has to go somewhere. A direct strike on NATO soil, or a nuclear escalation that would alienate China too, would cost him more than it wins, so it goes somewhere quieter: disruption built on plausible deniability, kept just under the threshold that would trigger a formal NATO response, aimed at the everyday infrastructure and economies of the allies still backing Ukraine. That's the shape of the pattern below.

What Drives Russia

To Understand Russia You Need To Understand The Oligarchy

Russia is a system where a small, tightly connected group of ultra-wealthy figures — the oligarchs — keep their fortunes only by staying loyal to the man at the top, and where state power and organised crime blur into the same thing.

1985–91Reform, then collapse. Gorbachev's perestroika opens the door to private enterprise; when the USSR falls, President Yeltsin privatises vast state industry to a small circle of well-connected businessmen — the first oligarchs.
1999–2000The oligarchs back Putin. A little-known former security official, backed by oligarchs seeking a protector for their new fortunes, becomes acting President, then wins election in 2000.
Summer 2000The deal. Putin calls Russia's most powerful oligarchs to the Kremlin: stay out of politics, defer to his authority, and keep your fortune.
2003Khodorkovsky. Once Russia's richest man, arrested and imprisoned for a decade after funding opposition parties — a clear signal of what happens to those who reneged.
2020Term limits removed. A constitutional referendum lets Putin remain president indefinitely.
2022Sanctions bite. Western sanctions freeze oligarch assets abroad following the invasion of Ukraine.
2026Seizure without conviction. A law effective 1 September 2026 lets the state freeze and seize the property, homes and bank accounts of Russians abroad who criticise the war or government — before any court conviction, widening an existing 2024 law and tightening control over dissent, elite or otherwise.

To stay in power, Putin needs one thing: Western support for Ukraine to crack before Russia's own patience does.

That means holding the line on infrastructure disruption and economic pressure, waiting out the September 2026 Duma elections before any new conscription wave, and betting that wavering US and European backing gives him room to keep going. It's a strategy aimed at time, not territory.

Listen to Sir Bill Browder on Putin, the oligarchs, and the system that protects him.

John Foreman CBE, former British defence attaché in Moscow (2019–2022), on Putin and succession.

The roadblocks

The roadblocks to defeating Ukraine.

Putin can't win outright — but he doesn't need to. He needs the resolve of Ukraine's four principal backers to crack before Russia's own patience does. Here's where each one stands.

🇺🇸 USA

Erratic & divided loyalties

American backing is the single largest lifeline Ukraine has, and Russia is very unlikely to target the US directly — it's simply too powerful to provoke. That makes wavering American resolve, not military defeat, the likelier route to a Russian "win."

In 2026 the Trump administration eased sanctions on Russian oil exports — sanctions imposed in the first place because of the invasion — after the US and Israel's war with Iran disrupted the Strait of Hormuz and pushed oil prices above $100 a barrel. French President Macron publicly pushed back, arguing sanctions on Russia should stay in place.

Whatever the reasoning, the practical effect is the same: Ukraine cannot assume it has full, unwavering American backing — and that uncertainty alone changes the calculation for everyone else on this list.

Wavering

🇩🇪 Germany

Rise of pro-Russian leadership on the horizon

Germany's AfD — a party Western officials have described as pro-Russian in its foreign policy leanings — has polled as one of Germany's most popular parties through 2026.

That matters because Germany has been one of Ukraine's most significant European backers, in both military and economic terms. A shift in Germany's governing coalition toward a party less committed to that support would remove a substantial pillar from under the current level of Western backing.

Neither this outcome nor France's is settled — but both represent a real possibility of cooling continental support for Ukraine over the next couple of years, exactly the kind of softening this argument depends on.

Under pressure

🇫🇷 France

High potential for Nationalist leadership

France has been one of the more vocal defenders of maintaining pressure on Russia — Macron publicly pushed back against the US's 2026 sanctions relief. But its own political future is less certain.

France's 2027 presidential election has consistently shown strong polling for Marine Le Pen's National Rally, a party with a similarly Russia-sympathetic foreign policy lean to Germany's AfD.

If Germany and France both drift this way around the same period, the continental backing Ukraine currently relies on could soften from two directions at once, not just one.

At risk in 2027

🇬🇧 UK

Has the will, what about the wharewithal?

The UK is independent in foreign policy but isn't the largest military or economy in Europe — on its own, it was never going to be the decisive factor. But if American and continental backing softens, the UK's contribution becomes proportionally more significant almost by default.

That's exactly what makes UK infrastructure a more, not less, attractive target over time. A cable incident, timed alongside domestic disruption, is a far cheaper way to blunt a smaller ally's capacity to keep backing Ukraine than anything that risks a direct NATO response.

Russia is very unlikely to target the US directly, and unsettling Germany or France's domestic politics is a slower, less certain game than sabotage. The UK's cable-dependent, hard-to-defend infrastructure is the most efficient lever left — which is the argument this page has been building toward.

The pivot

The mechanism

So how does Russia distract the UK?

Not with tanks. With the one capability that lets it reach the seabed where nothing else can follow, and a playbook built to keep its fingerprints off every attack.

Step one

Disrupt the fragile online systems that run the country.

Not a hostile state directly, but a Russian ransomware gang operating with what looks like state protection. The FBI estimates Conti hit over 1,000 victims worldwide, with payouts exceeding $150 million. Its alleged leader, "Stern" — identified as Russian national Vitaly Kovalev — reportedly lives freely between Moscow and St Petersburg with a crypto fortune in the hundreds of millions. Russia doesn't extradite its own citizens; he's never faced trial. He may be on track to become the first malware billionaire.

Which raises the obvious question: is Conti simply tolerated inside Russia, or is it closer to a state-sponsored online mercenary group — free to operate against the West as long as it never turns on the Kremlin?

BBC Cyber Hack: The Conti Files cover art
BBC's Cyber Hack: The Conti Files — the full story, from Redcar to Conti's collapse.

Some Of Conti's Historic Targets

Business

Using their own data against them

Fat Face, 2021 — systems compromised, with the ransom negotiation reportedly involving the attackers reviewing the company's own proprietary sales data as leverage.

Healthcare

Downing hospitals like flies

Ireland's HSE, May 2021 — around 80% of IT systems encrypted, hospitals forced back onto pen and paper, diagnostics and medical records inaccessible for roughly four months. Staff had no way to communicate between departments or pull up patient notes. The same month, New Zealand's Waikato District Health Board was hit the same way, knocking out IT and phone systems across five hospitals for weeks.

Food distribution

Stopping the food flowing

KP Snacks, 2022 — deliveries to UK supermarkets disrupted for weeks; the company warned it could not "safely process orders or dispatch goods."

Government

The fallout

Redcar & Cleveland Borough Council, 2020 — knocked offline for almost a week, with "catastrophic" data loss to social care, billing and housing services.

Costa Rica, 2022 — a sustained attack paralysed tax collection and customs and left thousands of public workers, including teachers, without pay. Facing public protests over the unpaid wages, the incoming president declared a national emergency, saying the country was "at war" with the attackers.

Scottish Environment Protection Agency, 2020 — systems attacked and data encrypted; the agency refused to pay, and the stolen data was later leaked online.

Given the state of our government's own systems, it's unlikely that services like the NHS have got on top of the kinds of deficiencies Conti used to shut down health services in Ireland and New Zealand. To a certain extent, we're sitting ducks.

The UK government now treats a coordinated version of this — several of these systems hit at once — as a realistic possibility, not a hypothetical, and is actively working to get the population prepared for a week of coordinated disruption.

The Cabinet Office's 2026 Resilience Action Plan Implementation Report confirms a much larger public-awareness campaign is launching to push household preparedness guidance in front of more people, explicitly citing cyberattacks and hostile-state threats among the scenarios it's preparing for.

Step two

Cut the cables while resources are already stretched.

While the country is dealing with the fallout above — and the UK's cyber, emergency and civil response capacity is already stretched thin — the undersea cables serving Britain are cut. That hampers recovery efforts precisely when they're needed most, and turns what could have been a bad week into months of sustained disruption.

Opinion from Christopher Steele, former head of MI6's Russia desk.

It's Happened Before

This Isn't The First Time

Cable damage happens on a regular basis — mostly ship anchors — and deliberate sabotage sits on top of that baseline. The cause of some of the outages below isn't clearly established, and some may simply be accidents.

Britain sold its own cable-repair fleet (6 ships) to Singapore in March 2025 — leaving the UK with no repair ship of its own out of a global fleet of 60 ships, and no jurisdiction to prioritise repair in the event of a major sabotage event, which could take months to fix.

Tonga, 2019

What happened

The Pacific nation's sole international cable was cut. The only fallback was a single satellite dish at a government office — hundreds queued for a slow, shared connection while banking and flights were disrupted for weeks.

Weeks down

Vietnam, 2022–23, recurring

What happened

Four of Vietnam's five international cables failed simultaneously from November 2022; by February 2023 the fifth had failed too. Every one of the country's cables was degraded or down at once, for months — and it has recurred since, including June and August 2026.

Months, repeatedly

Taiwan (Matsu Islands), 2023–25

What happened

Chinese vessels have cut cables to Taiwan's outlying Matsu islands repeatedly since February 2023 — five separate incidents in 2025 alone. Each time, the islands' roughly 14,000 residents lose their main link to the outside world and fall back on satellite. Taiwan has detained several of the vessels involved; Beijing denies any deliberate role.

Recurring, disputed cause

West Africa, March 2024

What happened

A suspected undersea seismic event off Ivory Coast severed four separate cables — WACS, ACE, SAT-3 and MainOne — in a single day, triggering a near-total internet outage across 13 countries including Nigeria and Ghana. Repairs took weeks.

13 countries, weeks

Red Sea, 2024–2025

What happened

Ship-anchor congestion near the Suez Canal cut three to five cables at once, disrupting Africa, Asia and the Middle East. Microsoft Azure had to reroute and rebalance traffic in real time; repair took six to eight weeks.

Weeks, several cables

Baltic Sea, since Nov 2024

What happened

At least 11 cables cut in the region within about two years. Germany's defence minister called the C-Lion1 and Sweden–Lithuania cuts sabotage; Finland detained the tanker Eagle S — carrying Russian oil and widely described as part of Russia's "shadow fleet," though flagged in the Cook Islands rather than Russia itself — suspected of deliberately dragging anchor. NATO launched "Baltic Sentry" in response.

Ongoing, disputed cause
Reuters: the UK deploying military to deter Russian submarines.

Russia has spent fifty years building the one capability nobody else has: a fleet built specifically to sabotage the seabed at depths where nothing else can follow.

GUGI — the Main Directorate of Deep-Sea Research — is Russia's dedicated undersea unit, headquartered in St Petersburg with its main submarine base at Olenya Bay on the Kola Peninsula, deep in the Russian Arctic. Unusually, it reports directly to the Ministry of Defence rather than through the Navy, and it stayed funded even through the 1990s when the rest of the Russian Navy was mothballed for lack of money.

Its flagship submarine, Losharik, is believed capable of operating at depths of several thousand metres — far beyond where cable-repair ships or accidental damage normally reach. Independent naval analysts assess that GUGI's deep-ocean sabotage capability "greatly exceeds" that of the US and the whole of NATO combined.

The UK's own answer is a single ship, RFA Proteus. A second was planned; the 2026 Defence Investment Plan dropped the commitment.

The UK can only monitor a small fraction of its undersea cable infrastructure — never mind do anything to protect it.

A Soviet-era submarine, representative of the class of vessel GUGI operates, docked in Kaliningrad

GUGI vs. the UK's answer to it

GUGIAround six deep-sea "station" submarines plus larger motherships, surface vessels including Yantar, and remotely-operated/autonomous vehicles. Reports directly to the Ministry of Defence.
LosharikOperates at depths of several thousand metres — beyond where almost all accidental cable damage, and most repair ships, can reach.
BelgorodSecond-largest submarine ever built. Carries Losharik and other deep-sea assets into position; commissioned 2022.
UK answerOne multi-role surveillance ship, RFA Proteus. A second vessel was dropped from the 2026 Defence Investment Plan.

A pattern, not an accident

The people who carry these out are rarely Russian. The pattern that recruits them is.

The consistent playbook of the last decade isn't a dramatic military strike — it's action built on plausible deniability, staying just below the threshold that would trigger a formal NATO response: deniable enough that no state can be clearly pinned down.

London, March 2024

A 20-year-old Leicestershire drug dealer with no prior convictions, recruited by Wagner-linked handlers online, recruited a second man, who recruited a third, who brought in two more — a chain of small-time criminals, each one step removed from Moscow. The target: an east London warehouse storing Starlink equipment and generators destined for Ukraine. The fire took 60 firefighters to control and caused over £1.3 million in damage.

At sentencing, the judge told the two men closest to the Russian end of the chain that in earlier generations there would have been a simple word for what they did: treason.

North London, May 2025

A car and two properties linked to Prime Minister Keir Starmer were firebombed in a coordinated arson campaign. A Ukrainian national, Roman Lavrynovych, and a Ukrainian-born Romanian citizen, Stanislav Carpiuc, were convicted and jailed — recruited and directed via Telegram by a Russian-speaking handler using the alias "El Money," who was never identified or charged.

It's one of more than 1,100 cases since 2022 in which Ukrainian nationals — a fifth of them minors — have been accused of arson, sabotage or terrorism apparently on Russia's behalf across Europe.

Jaguar Land Rover, August 2025

A cyberattack forced a total shutdown of JLR's IT systems and halted vehicle production at its major UK plants for roughly five weeks — assessed by the Cyber Monitoring Centre at £1.9 billion in total impact, the most economically damaging cyberattack in UK history, hitting over 5,000 businesses in JLR's supply chain and costing hundreds of jobs among smaller suppliers. It was significant enough that the Bank of England's November 2025 Monetary Policy Report cited it as a factor behind that quarter's weaker UK GDP growth.

A group calling itself "Scattered Lapsus$ Hunters" claimed responsibility — a loose, largely English-speaking crew, not a Russian state operation. But investigators have since been examining a possible Russian hand behind it, and the ransomware tooling this kind of group typically relies on is Russian-built. Whoever pulled the trigger, the infrastructure behind it runs through Russia.

Poland, August 2026

A fire at a WB Electronics plant manufacturing drone components for Poland and Ukraine's militaries was confirmed by Prime Minister Donald Tusk as deliberate arson and sabotage, with prosecutors investigating suspected involvement of a foreign intelligence service. Russia denied responsibility.

Leipzig, Germany, August 2026

An explosive-laden drone was found near a Ukrainian cargo aircraft at Leipzig/Halle Airport, forcing its closure; a second drone then collided with a diverted passenger jet. German officials and US intelligence assessed the drone belonged to a Russian intelligence service. Putin publicly denied it, calling the evidence "fabricated."

In every case above, the people who actually carried out the attack were non-Russian nationals or deniable proxies, and Russia rejected responsibility outright — even where investigators later identified a Russian state hand behind the recruitment. None of these came close to triggering a formal NATO collective response, even though one struck critical infrastructure inside NATO territory.

Why now, why the UK

The UK becomes a more attractive target precisely because it isn't the biggest one.

The dominoes are as follows:

1Russia keeps going, Ukraine makes progress slow and painful.
2Ukraine's best chance of winning is through making everyday Russians feel the pain.
3Europe now recognises this as defending against an advance on European borders, so continues to tool up Ukraine — enabling Ukraine to attack more Russian territory.
4Russia counters by trying to quell the appetite of Western countries to keep supporting this ongoing assault into Russian territory, without having a direct fight with them.

Here's how Western nations are tested

Start with the US. Washington is preoccupied elsewhere — its 2026 war alongside Israel against Iran disrupted the Strait of Hormuz, pushed oil prices past $100 a barrel, and was followed by sanctions relief for the very Russian oil exports those sanctions were meant to punish. President Trump's own posture on Russia has wavered ever since. There's no shortage of conspiracy theories about his personal relationship with Moscow — unproven, and not something we're endorsing here — but even without them, an unwitting Russian asset at best is still the practical read: Ukraine cannot assume it has full, unwavering American backing.

Germany and France aren't much steadier. The AfD — described by Western officials as pro-Russian in its foreign policy leanings — has polled as one of Germany's most popular parties through 2026, and France's 2027 presidential election has consistently shown strong polling for Marine Le Pen's National Rally. Neither outcome is settled, but Moscow-leaning rule in either country next year would leave the EU's collective backing for Ukraine in disarray.

That leaves the UK. Independent in foreign policy, but not the largest military or economy in Europe — and, by most measures, caught napping. There's no equivalent to Finland's Shelter 2026 civil defence exercise or Poland's £1.5 billion shelter modernisation programme here — just a general lack of readiness for any form of engagement, conventional or otherwise.

Britain Is Ill Prepared

Take the Royal Navy's two aircraft carriers, HMS Queen Elizabeth and HMS Prince of Wales: the fleet still doesn't have enough F-35B jets, escort ships or support vessels to reliably put either to sea as a credible strike group, and just one solid stores ship remains to support them, due to retire in 2028. Ground-based air defence is thin enough that a former British general told the BBC the country "does not have much" in the way of protecting its own key sites. The government has talked about closing the gap — an extra £15 billion pledged for defence, targeting 2.6% of GDP by 2027–28 — but the Treasury is already struggling to find the money to actually allocate it.

That combination plausibly makes UK infrastructure a more, not less, attractive target over time: a cable incident, timed alongside domestic disruption, is a far cheaper way to blunt a smaller ally's capacity to keep backing Ukraine than anything that risks a direct NATO response.

We think you should consider a UK-resident messaging and mail service to protect your organisation against what we believe is the next phase of the war in Ukraine.

How Things Break

How important is internal and external digital communications to your ongoing day-to-day business?

"UK-hosted" usually just means where your data sits. Everything that lets you reach it — signing in, proving a certificate is genuine, resolving a domain name — is a separate chain of its own, and each link can be anywhere in the world.

Even if you have UK based data storage - when you check your inbox, you may have sent more than 10 transmissions through to services outside the UK, before your list of emails has even been presented on the screen.

Almost every route out of Britain is a cable on the seabed — and the parts of "UK-hosted" email that actually depend on it are the parts you never see.

Around 60 subsea cables land in the UK, carrying an estimated 95–99% of the country's international data. Satellite exists as a backup, but current constellations carry roughly 150 terabits per second against the cables' combined ~3 petabits per second — a gap of around 20x. It cannot absorb the shortfall.

Signing in. Hardly anyone runs their own login any more — staff sign in through Google, Microsoft or similar, and that check happens on servers abroad, commonly in the US. A UK server is no use if the system that confirms who you are can't be reached.

Certificates. The padlock in your browser, and the proof that an email genuinely came from you, is backed by a certificate issued by a certificate authority — which can be based anywhere, and has to stay reachable for renewal.

DNS. The internet's address book isn't one database — it's a distributed chain of root, domain and authoritative servers worldwide. A change can take up to 48 hours to reach every copy, and every layer of that chain depends on the same cables.

Repair is now someone else's call. The UK's own cable-repair company, Global Marine Group, was sold to Singapore's Keppel Corporation in March 2025. Britain has no UK-owned repair ship left to send — routine repairs already take two to eight weeks, using foreign-owned ships, when one is free.

Our estimate of an isolated UK estate

Hour 0Cables severed. UK-to-UK traffic keeps moving. Overseas mail stops.
Hour 1–24Sign-in fails. Sessions expire and can't renew against Google or Microsoft. Staff are locked out of systems that are still running.
Days 1–10Admin consoles, licensing checks and DNS changes stop answering. Renewal windows for certificates start closing.
~Week 7First certificate failures. Certificates begin expiring across the estate; mail clients start refusing connections.
Weeks 2–8+Even a routine, accidental cut takes this long to repair — and there's no UK-owned ship to send.
NextReserve a place, before you need it
See plans

Figures cited from the Joint Committee on the National Security Strategy, Subsea telecommunications cables: resilience and crisis preparedness (2025), CSIS's 2025 Singapore case study on Global Marine Group's sale to Keppel, and public reporting on the Tonga, Egypt, Vietnam, Red Sea and Baltic Sea incidents. The "why" section sets out our own reasoning about a disputed and actively-investigated subject — it is not a certified intelligence assessment, and several specific attributions referenced are contested. Nothing here should be read as a claim that any individual named or unnamed party is guilty of a crime absent a conviction.
Photos: Hanna Balan (hero) and Alexandr Popadin (submarine) / Unsplash.