Intelligence agencies speak out: defence company executives are Russian targets
en gezamenlijke waarschuwing
European intelligence agencies are warning of a growing Russian threat to executives at defence companies. No fewer than five agencies jointly described to the Financial Times foiled plots and the observation of daily routines, both at home and at work. On the advice of security services, several executives have stepped up their personal protection in recent months.1 Dutch security services have warned the boards of defence companies about possible attempts on their lives, NRC reports.2
These warnings call for action at any company that contributes to military support for Ukraine in any form. That includes, for example, suppliers to the Dutch armed forces. The threat is aimed at the people who make decisions about production, deliveries and partnerships. Their role can attract the attention of a foreign intelligence agency, even outside the workplace. Their home environment and daily habits therefore deserve attention when securing both the individual and the company.
An executive under permanent protection
At Rheinmetall, among others, the threat has had far-reaching consequences. In 2024, US and German intelligence agencies uncovered a Russian plot to assassinate chief executive Armin Papperger. He has spoken out in favour of arming Ukraine and heads a major European defence group. According to Papperger, he is now protected day and night by private security staff and police.3 German media reported that his personal protection is comparable to that of the German chancellor.4
According to the intelligence agencies, reconnaissance, logistics, planning and execution of Russian operations are divided among different individuals or groups, sometimes in cooperation with criminal organisations. One intelligence officer points to the psychological aim: to make people hesitate before doing business with Ukraine.5 A personal threat can thus spill over into business decisions. Uncertainty about the safety of their families puts executives under pressure, and state actors exploit that pressure to influence decisions on deliveries and partnerships.
SMEs are targets too
This attention now clearly extends beyond the well-known names at large companies. Intelligence agencies also see a heightened threat to managers and staff at smaller firms, particularly manufacturers of drones and components.6
In Bavaria, for example, a German drone developer and manufacturer was probably targeted because of his open support for Ukraine, according to Tagesschau. In interviews and on social media, he had described how his products were being used in the war.7 From December 2025, a suspect acting on behalf of a Russian intelligence agency gathered information about the entrepreneur online and filmed his workplace, according to German prosecutors.
A second suspect is said to have taken over the assignment later. She went to the address where the developer was registered and filmed there. According to the prosecutors, this reconnaissance was probably intended to prepare further intelligence operations against him.8 The case shows that entrepreneurs at smaller companies are targets as well.
A small size or low profile therefore does not mean that a company runs less risk. The signals currently point mainly to executives, but other employees may also face increased risk.
What methods does a threat actor use?
A threat actor can combine information about an entrepreneur from a wide range of sources. A business profile shows their position and contacts, while other data can reveal their home environment, family or habits. Information posted years ago may also remain relatively easy to find online, without the person being aware of it.
The case of the director of the Dutch Military Intelligence and Security Service (MIVD) shows how much a forgotten account can reveal. In August, Dutch broadcaster NOS reported, based on research by de Volkskrant, that his Strava account was public. From his cycling and running activities, journalists were able to work out his home address and holiday destinations, among other things. The director said he had not realised the account was still active: he had deleted the app, but not the account. After the newspaper's questions, the account was made private and he requested its deletion. According to the Ministry of Defence, he regretted what had happened.9
Data that an executive has lost track of may still be accessible to others. The journalists found this information relatively easily and without any special powers. Targeted research allows an executive to have such data traced and shielded before anyone can misuse it.
The people around an executive matter as well. In an earlier Proximities investigation into an executive, the social media account of the executive's partner was enough to establish where they lived. What family members share can reveal information that the person concerned is carefully trying to protect.
Have personal exposure assessed
The security officer and the board decide together which executives and other key figures are assessed first for personal exposure. What someone does, who they do business with, how visible they are and what is known about threats all play a part. Agree at the outset who will assess the findings and who will carry out the measures.
With the Online Exposure Scan, Proximities investigates, within an agreed scope and with appropriate consent, what information about a person and their environment can be found in public and semi-public sources. The researchers show which data is available, how an outsider could obtain it and which vulnerabilities follow from it. In a personal briefing, the findings are translated into concrete mitigating measures.10
Where the situation calls for it, Proximities carries out a threat assessment to establish which actors pose the threat, what capabilities they have and how those risks should be mitigated. Finally, a Physical Exposure Scan assesses the security of the physical environment, including the home. This determines which additional physical security measures are needed to protect the executive and their family.11
At Rheinmetall, an assassination plot led to permanent protection. In Bavaria, a workplace and private surroundings were reconnoitred. These events give other defence companies reason to have their own security situation assessed: find out what information about executives is available, address avoidable exposure and make sure the agreed measures are carried out.
Sources
1. Sam Jones, Laura Pitel and Sylvia Pfeifer, Russia steps up bid to kill European defence chiefs, spy agencies warn, Financial Times, 11 October 2026.
2. Tom-Jan Meeus, ‘Bestuurders van Nederlandse defensiebedrijven zijn doelwit Russische aanslagen’, NRC, 11 October 2026.
3. Jones, Pitel and Pfeifer, Russia steps up bid to kill European defence chiefs, spy agencies warn.
4. Axel Spilcker, ‘Armin Papperger: Rheinmetall-Chef wird geschützt wie der Bundeskanzler’, Kölner Stadt-Anzeiger, 27 August 2025.
Die Zeit, ‘Armin Papperger: Sicherheitspanne bei Rheinmetall-Chef’.
5. Jones, Pitel and Pfeifer, Russia steps up bid to kill European defence chiefs, spy agencies warn.
6. Ibidem.
7. Florian Flade, Russische Geheimdienste: Rüstungsbranche im Visier, WDR/Tagesschau, 25 March 2026.
8. Der Generalbundesanwalt beim Bundesgerichtshof, Zwei Festnahmen wegen mutmaßlicher geheimdienstlicher Agententätigkeit, 24 March 2026.
9. NOS, MIVD-directeur had openbaar account op sportapp Strava, huisadres te achterhalen, 7 August 2026, based on reporting by de Volkskrant.
10. Proximities, Online Exposure Scan, product page, undated; accessed 14 October 2026.
11. Ibidem.
Stay ahead
subscribe to ourinsights
Subscribe to our monthly insights and receive the latest security insights straight to your inbox