How False Claims About the Kraków Shooting Spread, and Where They Could Lead
Updated: 1 hour ago
Situation as of the afternoon of 8 November 2026. This is a developing situation and our judgements may change.
Latest: read our 9 November disinformation update for the attacker's death, the Russian-link claims and false claims about the 11 November march.
The first shots on the Rynek Główny were fired at around three o'clock on Saturday afternoon. Within hours a second story was being built on social media, and it ran faster than the investigation itself.
By the evening, the attacker had been called a foreigner, a Ukrainian, a soldier and a mercenary. There were said to be two gunmen. A police officer was said to have been killed, and the police were said to have been absent. None of this was true. Police and ministers rejected each claim, most of them within hours. But by then the claims had been copied, translated and turned into images, and some of them are still moving.
Our assessment is that the risk of disinformation escalating around the Kraków shooting is HIGH, and rising toward 11 November, Poland's Independence Day. The falsehoods themselves are not the main concern. The concern is that several separate stories are pushing toward the same conclusion, and that the calendar for the coming week gives each of them a new opening.
Who the attacker is: what is confirmed
Where verified facts are missing, false ones fill the space. Most of the claims below spread in the hours before officials had said who the attacker was. Here is what the authorities have now confirmed.
Fact | Confirmed by the authorities |
Name | Michał O. Under Polish privacy rules, only his first name and the initial of his surname are released. |
Age and citizenship | 24, a Polish citizen. |
Home | Ostrowiec Świętokrzyski, in Świętokrzyskie province. |
Record and permit | No criminal record. He held a legal firearms permit. |
Military service | None. The Defence Minister says he never served; his camouflage clothing only resembled a uniform. |
On the day | He drove a car onto the Rynek Główny wearing camouflage and a bulletproof vest, fired at people on the square and fled towards Kazimierz. Officers shot and detained him after a pursuit. |
Weapons | A semi-automatic AR-type rifle. About five weapons were in the car, and seven firearms and a large quantity of ammunition were found at his home. |
His family | His father, mother and sister were found shot dead at his home. Prosecutors say the evidence indicates that he also carried out those killings. |
Victims | Nine dead in all: six in Kraków and three at his home. Sixteen people were injured, among them two police officers and citizens of the UK, Portugal, Russia, Germany and Austria. |
Investigation | Prosecutors are treating the Kraków attack as a terrorist act, covering six murders and the attempted murder of many others, including officers. Charges are being prepared; the number of murder charges could rise to nine. |
Condition | Critical, after several operations. He has not yet been formally detained or questioned. |
Motive | Not established. The Interior Minister says initial findings point to very radical far-right views, which are being verified. Police have also spoken of a mental-health line of inquiry, and the national security adviser says every hypothesis is being examined, including his online activity. |
What was claimed, and what is established
Nearly every basic fact of the attack drew a false version. These are the main ones.
What circulated | Status | What is established |
The attacker was Ukrainian or foreign | False | He is a Polish citizen, Michał O., from Ostrowiec Świętokrzyski. |
There were two attackers, and a second was being sought | False | An early police error, withdrawn the same afternoon. There was one attacker. |
He was a soldier | False | He never served. His clothing only resembled a uniform. |
He fought in Ukraine, in Kursk, or with Azov or a foreign legion | No evidence | The claim has appeared only in Russian channels. |
A patch on his gear proves he was a mercenary | Misleading | The patch is a product anyone can buy. |
A Ukrainian flag was on his vest | Fabricated | The image was made with AI and carries a commercial model's watermark. |
"Sharpened" photos show his face | Unreliable | AI-generated. Different tools produce different faces, so innocent people can be mistaken for him. |
A "vaccinated Ukrainian" went mad | False | Built on AI output about an unrelated October event. |
Cars with Ukrainian plates fled the scene | No evidence | No official or visual confirmation. |
Foreigners took part in the attack | False | Said on a live broadcast, with no basis. |
A police officer was killed | False | Two officers were injured. Both are now out of comas. |
The police were absent, late or diverted to the Tribunal dispute | False | Officials say the first patrol arrived 23 seconds after the call. |
The attacker was killed by police | False | A foreign media error. He is alive and in critical condition. |
Nine people died on the Rynek | False | Six died in Kraków. Three family members were found dead at his home. |
Some gaps are real, and they matter just as much. No phone alert was sent to residents; the crisis centre says it received no request. Officials appealed for blood for an injured officer while the blood centre said its supply was sufficient. And on motive, official accounts still differ: the Interior Minister has spoken of a fascination with far-right ideas, police said there was no motive, and prosecutors are investigating a terrorist act. These are not disinformation. They are, however, the openings that false stories most often use.
Three engines
The false claims did not come from one place. We see three main sources, each with its own aims.
Russian military bloggers and Telegram channels. This is where the "Ukrainian trace" began. Photos of the attacker's gear carry the watermark of a Russian war-correspondent channel. The same channels called the attack "payback" for Poland's support for Ukraine. Russian tabloid sites then picked the claim up under headlines suggesting a Ukrainian link, and accounts repeated it in at least seven European languages, including Romanian, Hungarian, French, Italian, Czech, Spanish and German.
The Polish partisan arena. Some opposition politicians, a right-wing television channel and commentators described the attack as a failure of the state: police "absent", or diverted to the dispute over the Constitutional Tribunal. Others suggested foreigners were involved. We have seen no sign that this is directed from abroad. It is domestic politics, and it reaches a far larger Polish audience than any Telegram channel.
AI imagery. We have documented at least five AI-generated or AI-"sharpened" images. Many were made by ordinary users who wanted to see the attacker's face or support the police. The trouble is that different tools produce different faces, so innocent people can be mistaken for him. Some images were photographed off a screen to get past detection tools. An account in Michał O.'s name posted an AI image on 3 November, and a post on a messaging app that was cited as his appears to have been edited after the arrest.
One voice has been notably quiet. Russian state media have so far reported the official Polish account in neutral terms, including the fact that a Russian citizen was among the injured. That restraint gives them room. They can stay out, or they can step in quickly if events give them a reason.
Where the stories meet
Taken one by one, most of these claims are weak. Together they are stronger.
The story of a "Ukrainian trace", the story of a failing state, the claim that the attack was a "provocation", and the claim that the government will use it to ban the Independence Day march all lead to the same place: the Polish state is weak and its government cannot be trusted. Two of them also deepen the rift between Poles and Ukrainians.
That convergence matters more than who started any one item. A weaker Polish state and a wider Polish–Ukrainian rift have long been Russian aims in Poland. They can be served even when Polish actors, acting for their own domestic reasons, carry the message. Our judgement is that Russian networks are likely amplifying domestic division more than they are its only source. Officials are investigating disinformation from abroad, but no single coordinated operation has been shown.
The fight over motive
The most durable story is not a false claim at all. It is the argument over why he did it.
One side says a "mental illness" explanation is being used to hide far-right terrorism. The other says "terrorism" is a political label. Because the official accounts already differ, both sides can quote an official in support. We judge it highly likely that this argument will outlast 11 November, and that every new detail about the attacker's devices or online life will be clipped, faked or disputed the moment it appears.
The next five days
The window of highest risk runs from 9 to 12 November. Each scheduled event gives the existing stories new fuel:
Charges and the attacker's condition, 8 to 10 November. The wording of the charges will feed the argument over motive. If he dies, expect "silenced witness" stories and attempts to turn him into a martyr.
His online footprint, any day. Investigators may release what they find on his devices. Any ideological material will be contested at once, and forgeries are likely to appear beside it.
The foreign victims. People from five countries were among the dead and injured. The nationality of the foreign woman who was killed, and the return of victims to their home countries, will bring foreign audiences into the story.
End of mourning and funerals, 9 and 10 November. Moments of grief are emotional peaks, and images of grief tend to be misused.
Independence Day, 11 November. This is the peak. Marches will take place amid the Tribunal dispute and heavy policing. Whatever happens on the day, both political camps are highly likely to read it as proof of their own story. Any clash would be filmed and reframed within minutes.
The weeks after. A review of gun permits and how weapons are stored is expected. It is likely to bring messages about "disarming the Poles before a war".
Three ways this could go
Most likely (55 to 65 percent): contained, but loud. The argument stays mostly inside Poland. The "Ukrainian trace" lives on in Russian channels, with new "evidence", but gets little attention in mainstream Polish media. Political blame peaks around 11 November. There may be isolated harassment of Ukrainians, but no serious disorder.
Escalation (25 to 35 percent). A fabricated item goes viral: a fake manifesto, a forged document or a deepfake. Or something that happens at a march is presented as proof of state failure or of Ukrainian guilt. Russian state voices join in, and incidents against Ukrainians or at marches follow.
De-escalation (10 to 20 percent). Clear charges, a stated motive, calm marches and consistent official statements take away the stories' fuel within days. This is the least likely outcome. It would need everything to go right at once.
What could come next
Several new kinds of content are possible in the coming week:
Forged documents linking the attacker to Ukrainian service, such as enlistment papers, IDs or chat screenshots. Likely in Russian channels, though unlikely to reach mainstream Polish media.
A fake manifesto or diary attributed to him. A realistic possibility.
Deepfake audio or video of an official. A realistic possibility. There is a precedent involving a Kraków mayor.
Charity fraud using the names of the victims or the injured officers. Likely.
Glorification of the attacker in extremist online spaces, especially if he dies or his ideology is confirmed. A realistic possibility, and the main sign to watch for copycat risk.
"Poland is unsafe" messages aimed at foreign audiences, meant to put off tourists and investors. A realistic possibility.
The political consequences will take longer to show. "Disinformation" itself is becoming a charge each camp makes against the other, and that blurs what the public sees as false. A "censorship" counter-story is forming against the fast removal of content. The fight over gun permits is likely within weeks. And the themes of this week, namely state security, migration, Ukraine and the Tribunal, are highly likely to resurface in the 2027 parliamentary campaign.
The outcome with the lowest probability and the highest impact is a forged document that Polish politicians repeat in public. That would turn a Telegram rumour into an issue between Warsaw and Kyiv. We judge it unlikely, but it would be the hardest to undo.
What would change the picture
Polish mainstream media or politicians repeating the "Ukrainian trace" or a forged document
Russian officials or state television adopting the "payback" or Ukrainian framing
A manifesto, diary or deepfake that spreads faster than the official rebuttal
Calls to act against Ukrainians, or hoax threats naming schools, churches or marches
Memes or tributes to the attacker in extremist channels
What is holding it back
The brakes are real. Police and ministers rebutted the main falsehoods quickly and confirmed the attacker's citizenship within hours. The national counter-disinformation centre is monitoring in crisis mode and flagging content to platforms through fast channels, and fact-checkers have debunked the main items. Politicians across the spectrum have called for protests to be cancelled during mourning. Ukraine's president offered condolences quickly, and Ukrainian media are rebutting the "Ukrainian trace" for Ukrainians living in Poland.
Whether those brakes hold through 11 November is now the central question.
Risk assessment
Disinformation escalation potential, Poland, next 7 days: HIGH, rising to 11 November, then easing if the marches pass calmly. Confidence: moderate.
Political blame, motive contest and AI imagery: HIGH. These are the most active fronts.
Anti-Ukrainian attribution, hoaxes and threats, and fraud exploiting the tragedy: ELEVATED, rising.
Russian state-level exploitation and gun-rights narratives: MODERATE, rising.
International misreporting: MODERATE, easing.
For the facts of the attack itself, see our first situation report and the 8 November update.
Full situation report
This page is a public summary. Our complete report, with a detailed chronology, threat ratings by location and time window, conflicting claims and a forecast, is available to organisations and private clients on request.
Comments