The Galați Drone Incident: What Happened Online Before and After the Drone Struck a Residential Building

The incident that occurred during the night of May 28 to 29, 2026 did not take place in isolation, but rather within a broader context of escalating Russian drone activity near the Romanian border. On May 23, the Ministry of National Defence signalled the most recent Russian army attack on Ukrainian infrastructure near Tulcea County, making the drone subject a constant and recurring element of public interest in the Romanian information space.

The chronology of events during the night of May 28 to 29 is as follows:

• 21:15 – Russia launches an attack on the Ukrainian ports of Reni, Orlovka, Chilia, and Vâlcove.
• 01:19 – Two F-16 aircraft take off from Fetești Air Base 86, supported by an IAR 330 SOCAT helicopter, with target engagement authorisation for the entire duration of the alert.
• 01:46 – The drone that would cause the incident is identified 19 km east of Reni.
• 01:52 – The drone enters Romanian airspace; ISU Galați sends a Ro-Alert message to the population.
• 01:56 – The drone is lost from radar after travelling approximately 10 km over national territory.
• 01:57 – The drone crashes into a residential building in Galați, the impact being followed by an explosion and the outbreak of a fire on the 10th floor.
• 02:07 – The first response crews arrive at the scene.
• 02:31 – The fire is extinguished.
• 03:40 – The red intervention plan is deactivated.

The incident occurred one day after the MoND had announced the signing of four contracts, totalling nearly 700 million euros, under the European SAFE programme (the newest and most comprehensive European instrument dedicated to defence). SAFE offers member states loans of up to 150 billion euros for urgent and large-scale military acquisitions, covering categories such as ammunition, drones, air and missile defence systems, cyber, and military artificial intelligence. Romania received the second largest allocation in the programme — 16.68 billion euros — after Poland, confirming both the scale of its military modernisation needs and the country's active role in the European security architecture. The four contracts signed concerned the acquisition of military reconnaissance drones and MANPAD MISTRAL anti-aircraft missiles, purchases that reflect precisely the air defence vulnerabilities exposed by the incident the following night. 

Why was the drone not shot down?

The Ministry of National Defence (MoND) explained that the time available for identifying, assessing, and engaging a small drone flying at low altitude is extremely short. Engagement over an urban area presented significant risks — the resulting debris could produce effects comparable to the drone's impact itself — and the aircraft type was not known at the time. The legislative framework in force during peacetime further restricts intervention options, conditioning the opening of fire on the protection of life and property. Based on public briefings, the MoND concluded that there were no real opportunities for engagement under safe conditions.

Pre-attack narrative preparation on social media

The security context described above did not go unnoticed in the information space. The two networks of coordinated pages identified in the analysis below did not react to the Galați incident — they preceded it. Their activity began days before the impact, at a moment when the drone subject was already present and active in the public sphere.

On May 23, the most recent Russian army drone attack on civilian and infrastructure targets in Ukraine, near the river border with Romania in the Tulcea County area, generated a Ro-Alert from the MoND, without any unauthorised airspace intrusions or impacts on Romanian territory being reported.

Network I – coordinated activity on the topic of drones

The event nonetheless created fertile ground for information manipulation. Four days later, on May 27, a network of 21 coordinated pages simultaneously distributed an identical alarmist message: "BREAKING NEWS! Russian drone in Romania! The population has been evacuated" — exploiting the public anxiety accumulated around the real incident to amplify fear and disinformation among the population.

The coordination is evidenced by the posting timestamps: all 21 pages distributed the message within just seven minutes (between 12:33:40 and 12:40:55). Such a short interval indicates automated or centrally coordinated distribution, in which the content was prepared in advance and launched simultaneously, suggesting that this campaign was not an improvised reaction but a premeditated action, synchronised with the drone topic already in the public eye. 

The network cumulatively has nearly 3,7 million followers, over 5,8 million views and 44.000 shares, giving it significant potential for influencing public opinion.

Network II – coordinated activity on the topic of civil emergency

On May 28, the second identified network, consisting of 50 pages, distributed an identical message invoking the authority of Raed Arafat to urge the population to prepare a 72-hour emergency backpack. The content mimics official civil protection communication, lending it the appearance of institutional legitimacy.

Analysis of posting times reveals a more sophisticated pattern than in the previous case: distribution unfolded in four coordinated waves — the first around 11:17–11:18, the second between 12:02–12:13, the third around 15:00–15:01, and the fourth in the evening, between 19:03 and 19:19. The short intervals within each wave (sometimes under ten seconds between posts) confirm process automation, while the multi-wave structure indicates a deliberate strategy for keeping the subject active in users' feeds throughout the entire day. Given that the drone attacks took place that same night, these messages functioned as a possible premeditated psychological preparation of the public, coordinated in time with the moment of the attacks.

The network cumulatively has nearly 8,7 million followers, over 11,8 million views and 90.000 shares, representing significant reach for a coordinated disinformation campaign. 

What is being communicated on social media?

The Galați incident is not an isolated case in the Romanian disinformation landscape. Funky Citizens has documented similar patterns in two previous analyses: in September 2025, following the entry of a Russian drone into Romanian airspace in the Tulcea County area, coordinated networks propagated narratives framing the incidents as "NATO-manufactured hysteria," minimising the real threat and delegitimising the response of Romanian authorities (Analysis of false narratives regarding Russian drone incidents in Romanian airspace). In October 2025, the explosion in the Rahova neighbourhood was rapidly transformed into a vector for disinformation, with conspiracy theories diverting public attention away from the confirmed findings of the investigation (The Rahova Case: from tragedy to conspiracy). Both cases confirm a recurring pattern: events with high emotional impact and a high degree of informational uncertainty systematically become opportunities for the amplification of coordinated disinformation.

In total, we collected 14,033 general social media posts between 00:00 on May 28 and 11:00 on May 29. These posts were distributed across the following social media platforms: Twitter/X, Instagram, YouTube, TikTok, Facebook, Bluesky, Telegram, Wire, and press outlets.

You can access our network analysis at this link.

The 80 most widely shared clusters address the following themes (link):

1. Incident, impact and breaking news accounts – 1,162 mentions. The largest cluster describing the main event: a drone crashing into or striking a residential building in Galați, the impact followed by an explosion and fire. The texts include many "breaking news," "latest," and "major/maximum alert" formulations, and frequently link to the "moment" of impact, images, residents' reactions, or details about the affected apartment. This cluster also includes external reshares.
2. Official confirmations, NATO/MAE/CSAT, and international reactions – 746 mentions. This cluster focuses on institutional and diplomatic communications: the Ministry of Defence confirms the entry of a drone into Romanian airspace, the Ministry of Foreign Affairs informs NATO, and some texts reference NATO reactions, Article 4, CSAT, President Nicușor Dan, the United States, or other international responses. Texts frame the incident as an airspace violation, a serious situation, or an escalation, with some mentioning political or diplomatic measures such as convening the CSAT or closing the Russian Federation's General Consulate in Constanța.
3. Casualties, evacuations and emergency interventions – 387 mentions. This cluster groups texts about the consequences for the population: injured persons, a woman and a 14-year-old boy, burns, panic attacks, approximately 70 persons evacuated or self-evacuated, and the absence of fatalities in certain updates. References appear to interventions by ISU, SMURD, Ambulanța, the Police, MAI, and SRI, to the securing of the area, and to the fact that the drone's payload had exploded. The tone centres on the immediate effects on residents, the condition of the victims, and the management of the situation on the ground.
4. Attribution of the drone and description of its origin – 315 mentions. Texts in this cluster discuss the drone's origin: some directly state it was Russian, Shahed/Geran, or Geran-2, while others pose questions such as "where was the drone actually from" or "what is written on the drone." Formulations also appear about its trajectory — departing from Russia, passing through Ukraine, and arriving in Romania.
5. Defence capability, shoot-down, and anti-drone equipment – 167 mentions. This cluster addresses the question of why the drone was not shot down and what capabilities Romania has. Some texts accuse the authorities of incapacity, incompetence, or failure to prevent the incident, while others offer explanations attributed to the MoND: very low altitude, short time in Romanian airspace, risk that projectiles or debris would cause greater damage in populated areas. References appear to F-16s, radars, the SAFE programme, contracts for anti-drone equipment, and the need to strengthen defence.
6. Internal politicisation and blame/accusations among political actors – 143 mentions. This cluster uses the incident for internal political interpretations. Sorin Grindeanu, George Simion, PSD, AUR, S.O.S. România, POT, PNL, USR, Oana Țoiu, Bolojan, and Nicușor Dan are mentioned. Some texts accuse politicians or parties of exploiting the situation politically, of having blocked security measures, of "playing Moscow's game," or of feeding political hypocrisy. Other texts include anti-Kremlin positions and criticism of those who justify Russia, as well as a satirical text questioning the attribution to Russia and invoking Ukraine, NATO, the MoND, and the political class.

What conclusions do we draw?

The incident of the night of May 28 to 29, 2026 illustrates an increasingly well-documented dynamic in the Romanian information space: high-emotional-impact security events are no longer merely news — they become, in real time, raw material for coordinated manipulation campaigns. The two identified networks did not react to the incident; they accompanied it and acted early, which indicates an active disinformation infrastructure, prepared to exploit any window of informational vulnerability.

Analysis of the 8,913 posts directly addressing the incident confirms that narratives circulated online which minimised the threat or amplified the state of panic — all exploiting the same gap: the interval between the occurrence of the event and the provision of clear and complete official information.

The present case confirms two systemic tendencies that Funky Citizens consistently documents. First, disinformation in security contexts does not necessarily seek to convince, but to disorient — that is, to occupy the public's cognitive space before verified information reaches them. Second, the coordinated distribution infrastructure is already in place and operates independently of the subject matter, capable of being rapidly activated around any sensitive event.

The response to this reality cannot be merely reactive. It requires rapid and clear institutional communication in moments of crisis, as well as the technical capacity to detect coordination in real time, so that the public is promptly informed about the false narratives circulating in the online space. Without these, every security incident at the border will continue to be mirrored, in the online space, by a second incident — harder to manage and slower to remedy — one that erodes citizens' trust in the capacity of institutions to respond in moments of crisis far more deeply.

Methodology used in this analysis

The analysis is based on four datasets collected through third-party providers from the platforms Twitter/X, Instagram, YouTube, TikTok, Facebook, Bluesky, Telegram, and Wire, supplemented by posts from online press sources. The data were processed and explored using the Python programming language. On this basis, we constructed a Social Network Analysis in which nodes represent the accounts that posted, and the links between them are verbatim-shared texts. The resulting graph visualises the connections between accounts that distributed identical content, enabling the identification of coordination patterns and amplification structures in the online space.