Who was the Kraków gunman on 7 November, and is it true the government staged the attack?

Who was the Kraków gunman on 7 November, and is it true the government staged the attack?

Checked · updated · watching until

Translated from Russian. Original

Rumor: After the shooting on Kraków's main square on 7 November 2026, several stories spread on social media: the attack was "staged by the Polish government and the EU", the gunman was "a Ukrainian", "a mercenary" or "a soldier", there was a "second shooter" on a church roof, and the police "arrived late". On top of that came AI photos of the gunman with a minister and pictures of people who had nothing to do with it.

01 Verdict

Fake

The attack itself is real: on 7 November a 24-year-old Polish citizen fired from a car at people on Kraków's Main Market Square, killing six. There is no evidence at all that the government or the EU "ordered" it. The stories about a "Ukrainian", a "mercenary", a "soldier", a "second shooter" and "late police" have been debunked, and the most viral photos of the gunman were made by AI or show other people.

High: the police, prosecutors and several independent outlets and fact-checkers (Demagog, OKO.press, Konkret24, Maldita) agree. Not "very high": the "government plot" is debunked mainly by the Polish authorities themselves, and investigators have not yet named the gunman's motive.

02 Signs of manipulation

The tricks this rumor uses to influence you, and how not to fall for them.

Pressure on the reader:high
  • "The authorities and the EU ordered the attack"Conspiracy theory
    A story about an attack "planned by the Polish authorities with the EU's involvement" (per Poland's Ministry of Digital Affairs).

    How it works: The tragedy becomes "proof" of a "secret plan", and every official statement starts to look like part of the deception.

    How to resist: Ask what facts the author has besides suspicion: the gunman has been identified and the investigation is being conducted openly.

  • An "outsider" is to blame — a Ukrainian or an anti-fascist“Us vs. them”
    Some pass the gunman off as a Ukrainian mercenary, others as a participant in a "Refugees Welcome" march.

    How it works: Anger at an entire group of people gets in the way of thinking and pushes you to share without checking.

    How to resist: Until the police have named the attacker's nationality and connections, don't trust posts that already "know who's to blame".

  • A patch as "evidence"Precision for credibility
    A pirate flag on a backpack is passed off as the sign of the FOG group, even though such patches are sold online.

    How it works: A specific detail in a photo creates a feeling of proof.

    How to resist: Search online shops for the patch: if anyone can buy it, it proves nothing.

  • AI photo with a ministerFake authority
    The image "Kierwiński shakes the gunman's hand" carries an AI watermark (Demagog).

    How it works: A photo with a recognisable politician looks like irrefutable proof of a connection.

    How to resist: Find the original with a reverse image search and see whether Demagog or Konkret24 has checked the photo.

  • Real video, wrong meaningTruth mixed with fiction
    Genuine footage of police reacting to a priest on a terrace is captioned as a "second shooter on the roof".

    How it works: A real clip makes the false caption believable and heightens fear.

    How to resist: Check video captions against police statements: the clip itself may be real while the explanation is not.

03 Claims and facts

  • «The attack was planned by the Polish government and the European Union»False

    There is no evidence. The gunman has been identified: a 24-year-old Polish citizen from Ostrowiec Świętokrzyski who had held a gun licence since March and who, according to investigators, killed his father, mother and sister before going to Kraków. Police said he acted alone; the case is handled by the National Prosecutor's Office. Poland's Ministry of Digital Affairs called the "government and EU plan" story false and put its possible reach at 200 million impressions (total impressions, not the number of people). The "EU stages terrorist attacks" theme also appears in a review of false narratives by the fact-checkers at Demagog.[1][2][5][3][6][11]

  • «The attack was staged to ban the 11 November Independence March»False

    Prime Minister Donald Tusk said the march would not be banned. On 11 November the Independence March in Warsaw went ahead: up to 250,000 people took part, according to the Warsaw Security Centre (the city's security service). Mayor Rafał Trzaskowski said it was calm, apart from banned pyrotechnics. Carrying weapons in Warsaw was temporarily banned for the day.[9][13][14]

  • «The gunman is a Polish soldier»False

    Defence Minister Władysław Kosiniak-Kamysz denied this: the attacker is not serving and has never served in the Polish Armed Forces. The story was based on his clothing, which looked like a uniform; by one estimate it reached about 18 million impressions before the denial.[9][11][3]

  • «The gunman is Ukrainian, a mercenary from Ukraine's International Legion, or linked to the American group FOG»False

    Police confirmed he is a Polish citizen. The "proof" of a Ukrainian link was a pirate-flag patch on his backpack. It is the emblem of the pirate Blackbeard; such patches sell online for a few dozen złoty, and FOG's emblem is different. According to OKO.press, the story went through the Russian Telegram channel Shot and Belarusian state radio and reached websites in Bulgaria, Greece, Spain, China and Vietnam.[11][8][6]

  • «There was a second shooter on the roof of St. Mary's Basilica»False

    Lesser Poland police denied this: in the video, people are reacting to a priest who stepped out onto the terrace of the church house to look at the square. Police stressed that there was only one attacker.[10][9]

  • «The police were late because they were busy with protests»False

    According to the police and Interior Minister Marcin Kierwiński, the first patrol responded 23 seconds after the call, and about three minutes later officers were already shooting at the attacker.[9][13]

  • «Photo: Interior Minister Kierwiński shakes hands with the gunman»False

    The image was made by AI from a real photo of the minister with a Warsaw community activist. It contains an invisible AI watermark (SynthID), and the Hive detector also flagged it as AI. The Interior Ministry is referring the case to prosecutors.[7][4]

  • «Photo and video: the gunman took part in an anti-fascist demonstration with a "Refugees Welcome" sign»False

    The footage was filmed at an anti-racist march in Łódź on 28 March 2026. The man in it told Konkret24 that it is him, not the gunman. The man with the sign in another photo from the same march is also someone else.[12][9]

  • «The attack on Kraków's Main Market Square really happened»True

    Yes. In the afternoon of 7 November 2026 a man drove onto the Main Market Square and fired at passers-by. Six people were killed (four Poles, a British man and an Austrian woman) and 15 more were injured, including two police officers. Police wounded and detained the attacker; he died in hospital on the morning of 9 November. The interior minister spoke of his far-right views, but prosecutors say the motive is still being established.[1][2]

04 Where the rumor came from

  • Kraków, Main Market Square · pl

    In the afternoon a man fires from a car at people on the Main Market Square. Six people are killed and about 15 injured; police wound and detain the attacker.[1][2]

  • Instagram, X · pl

    Around 18:00 an image appears claiming the "gunman is linked to mercenaries in Ukraine" because of a pirate-flag patch; an hour later pro-Kremlin accounts on X pick it up.[8]

  • Telegram · Shot · ru

    At 20:37 the Russian channel Shot writes about a FOG patch and a link to Ukraine's International Legion; around 21:30 Belarusian state radio repeats it.[8][6]

  • Poland's Ministry of Digital Affairs, NASK · pl

    At 17:00 the ministry convenes a crisis team with NASK (Poland's state cybersecurity centre) and the security services to track false reports.[3]

  • Facebook, X · pl

    An AI image of "Minister Kierwiński shaking hands with the gunman" spreads; a city councillor from Gdynia also posts it.[7]

  • OKO.press · pl

    OKO.press traces how the "Ukrainian mercenary" story travelled from Russian channels to Bulgaria, Greece, Spain, China and Vietnam.[8]

  • Poland's Ministry of Digital Affairs · pl

    The digital affairs minister reports that in the first 24 hours more than 2,000 accounts were flagged to platforms, and the main false stories reached more than 250 million impressions. The Interior Ministry refers the AI photo with the minister to prosecutors.[3][4]

  • Kraków

    The attacker dies in hospital. A silent march with the president and prime minister takes place in Kraków; the country holds two days of national mourning.[2][1]

  • Demagog, RMF24 · pl

    Roundups of the false stories: AI photos, other people in pictures, the "second shooter", the "late police", the "soldier".[6][9]

  • Warsaw · pl

    The Independence March goes ahead as usual, contrary to the claim that someone wanted to ban it. According to Warsaw's mayor, it was calm, apart from banned pyrotechnics.[14]

  • Maldita · es

    Spanish fact-checkers debunk the photo of the "gunman at an anti-fascist demonstration" circulating on Spanish-language X.[12]

How the text changed

  1. 7 November, evening: a pirate-flag patch → "the gunman is linked to American mercenaries in Ukraine"
  2. Russian Telegram: + "Ukraine's International Legion" and an "investigation" that does not exist
  3. Belarusian media: + "the attack was coordinated from Ukraine", "he got the weapon through an organised group"
  4. Meanwhile in Poland: "the gunman is a soldier" → "the government staged the attack to ban the Independence March" → "the government together with the EU"
  5. Counter-wave: a photo of a different man from an anti-racist march → "the gunman was an anti-fascist, not a far-right extremist"
  6. AI images: an "enhanced" face of the gunman, "the gunman with the minister", "the gunman in uniform with a Ukrainian patch"

05 What the media say

  • NBC News, EuronewsContext

    What is known about the attack: six dead, about 15 injured; the gunman, a 24-year-old Pole, died in hospital on 9 November; the motive is being established.[1][2]

  • Demagog (Poland)Debunks

    The AI photo with the minister; a breakdown of the Russian stories: the patch is not FOG's, the "Ukrainian mercenary", "the EU stages terrorist attacks".[7][6]

  • OKO.press (Poland)Debunks

    How the "mercenary" story travelled from Russian channels to media in five countries; such a patch can be bought online for next to nothing.[8]

  • RMF24 (Poland)Debunks

    A roundup of the false stories and the denials from the police, the defence and interior ministers, and the prime minister.[9]

  • Ukrinform (Ukraine)Debunks

    Russian and Belarusian fakes about a "Ukrainian trail" in the attack.[11]

  • Maldita (Spain)Debunks

    The video from the anti-racist march in Łódź does not show the gunman.[12]

  • Around Prague / Novinky (Czech Republic)Debunks

    A summary of the main false stories and their reach for Czech readers.[13]

06 Social media

  • X, Facebook, TelegramPanic

    The story that "the Polish authorities planned the attack together with the EU".[5]

    2026-11-07 · up to 200 million possible impressions (estimate by Poland's Ministry of Digital Affairs, 2026-11-10)

  • XPanic

    The "gunman is a soldier" story, based on photos of his clothing.[3]

    2026-11-07 · about 18 million impressions (per the Ministry of Digital Affairs, 2026-11-09)

  • XPanic

    A pirate-flag patch as "proof" of links to mercenaries in Ukraine.[6]

    2026-11-07 · more than 250,000 views on a single post (per Demagog, 2026-11-10)

  • XPanic

    A video of a "second shooter on the church roof".[13]

    2026-11-07 · about 1 million views on a single post (per Novinky as reported by Around Prague, 2026-11-09)

07 Similar rumors in the past

  • After the Southport attack (UK), the attacker was named as a Muslim migrant, "Ali al-Shakati", and the attack itself called a "false flag operation"

    Outcome: The name was invented by the website Channel3Now and denied by police: the suspect was born in Cardiff. The false story helped fuel riots across England.[15]

In common with past rumors

  • Right after a tragedy, while little is known, a convenient culprit is "assigned": a migrant, a Ukrainian, the authorities
  • The "false flag operation" story is launched within the first hours
  • Lies spread faster than official statements

What is new

  • The fakes are made by AI and caught by an invisible watermark (SynthID)
  • Within a day, one story reached media in five countries in different languages
  • The state immediately set up a crisis team and flagged accounts to platforms en masse

09 What to do

  • In the first hours after an attack, wait for statements from the police and prosecutors: early claims about the culprit often turn out to be false.
  • Check photos of "the gunman with a politician" or an "enhanced face" with a reverse image search and on fact-checking sites (Demagog, Konkret24).
  • Don't share posts that blame an entire nation or "the authorities" without evidence — it helps those who spread lies.
  • If you see a suspicious mass campaign in Polish, you can report it to NASK (Poland's state cybersecurity centre).

10 What we could not verify

  • The attacker's motive has not been officially established: the interior minister spoke of far-right views, while prosecutors say the motive is still being established.
  • The impression figures (200 million, 250 million, 18 million) are estimates by Poland's Ministry of Digital Affairs; no one has counted them independently.
  • The debunking of the "government plot" comes mainly from the Polish authorities themselves; independent outlets confirm the gunman's identity, but the investigation's evidence has not yet been made public.
  • Claims of a Russian role in spreading the stories are conclusions of the ministry, OKO.press and Demagog; we did not check the links of individual accounts to Russia ourselves.
  • We did not rerun the AI checks on the images (SynthID, Hive) ourselves — we rely on Demagog and PAP.
  • We know Konkret24's fact check of the photo from the Łódź march only as reported by Maldita and RMF24.

11 Sources

  1. NBC News — gunman who killed 6 people in Kraków dies in hospital (9 November 2026) · Reliable · accessed 2026.11.12
  2. Euronews — Polish president and PM join Kraków silent march (9 November 2026) · Reliable · accessed 2026.11.12
  3. Polskie Radio — Poland reports widespread disinformation after Kraków attack (9 November 2026) · Ordinary · accessed 2026.11.12
  4. Polskie Radio — AI image of minister and gunman to be referred to prosecutors (9 November 2026) · Ordinary · accessed 2026.11.12
  5. Zawsze Pomorze — 200 million impressions of a single false story (10 November 2026) · Ordinary · accessed 2026.11.12
  6. Demagog — how Russia exploited the Kraków attack (10 November 2026) · Reliable · accessed 2026.11.12
  7. Demagog — photo of Kierwiński with the gunman made by AI (9 November 2026) · Reliable · accessed 2026.11.12
  8. OKO.press — multi-layered disinformation about the Kraków gunman (8 November 2026) · Reliable · accessed 2026.11.12
  9. RMF24 — the photo with the minister, patches and the "second shooter": explained (10 November 2026) · Reliable · accessed 2026.11.12
  10. Interia — the "second shooter on the roof" turned out to be a priest · Ordinary · accessed 2026.11.12
  11. Ukrinform — the Kraków terrorist attack and Russian disinformation (11 November 2026) · Ordinary · accessed 2026.11.12
  12. Maldita — image does not show the Kraków gunman at an anti-fascist demonstration (12 November 2026) · Reliable · accessed 2026.11.12
  13. Around Prague (based on Novinky) — after the Kraków shooting, a wave of fakes flooded the internet (9 November 2026) · Ordinary · accessed 2026.11.12
  14. Nasze Miasto (via PAP) — Warsaw's Independence March was calm (11 November 2026) · Ordinary · accessed 2026.11.12
  15. Full Fact — misinformation after the Southport attack (2 August 2024) · Reliable · accessed 2026.11.12

#Poland#Kraków#shooting#terrorist attack#conspiracy theory#AI images#Ukraine#Russian propaganda

Latest news