Cyberattack on Femern Link Contractors, the Main Contractor for the Fehmarn Belt Tunnel

During the night of Monday 12 October 2026, the Fehmarn Belt immersed tunnel construction project was the target of a cyberattack. The IT systems of the contractor consortium Femern Link Contractors were affected
Credit/Quelle: Femern A/S

“The offshore tests with our IVY caisson were able to take place this week. This means that preparations for the lowering of the first special element are also progressing,” says Matthias Laubenstein, Contract Director for the Fehmarn Belt project.

Construction Site IT Systems Affected – yet Most Work Resumed Swiftly

Earthworks on both the German and Danish sides continued without interruption that week. In addition, some concreting work took place. In the assembly hall on the Danish side, steelwork on the reinforcement is continuing as usual. The production facility in Rødbyhavn was also set to resume operations shortly (as things stood on 16 October). The cyberattack is being investigated by the relevant Danish police authority. With regard to the ongoing investigation, Femern A/S has stated that it will not provide any further details on the cyberattack at this time.

IT Expert on the Topic of Cyber Resilience

Christian Lueg, IT security expert, ESET Deutschland GmbH

Credit/Quelle: ESET Deutschland GmbH

Christian Lueg, IT security expert at the cybersecurity company ESET Deutschland GmbH, commented on the attack at the request of tunnel: “The incident at the Fehmarn Belt Tunnel highlights that cybersecurity is crucial in large and complex infrastructure projects, even during the construction phase. Digital and physical processes are now closely interlinked on modern large-scale construction sites. It is important to keep an eye on the entire supply chain. Contractors, design offices and specialist service providers are closely interconnected digitally. If the digital systems of a key partner – such as the contractor in this case – fail, the consequences can be felt immediately on the construction site. Attackers do not necessarily need to directly manipulate construction machinery or industrial control systems to achieve this. Even the failure of supporting IT systems can mean that work can no longer be coordinated or carried out safely. How the attackers gained access to the systems has not yet been made public. At the same time, the case demonstrates that absolute security is virtually unattainable. An organisation’s cyber resilience is therefore crucial: attacks must be detected at an early stage, their impact limited, and affected systems restored quickly and in a controlled manner. Particularly in the case of long-term infrastructure projects, this aspect should be integrated into security planning from the outset. This presents a clear task for clients and contractors: they must jointly determine which processes can continue in the event of an IT failure and how a secure restart can be achieved. There is currently no reliable public evidence on which to base statements regarding the perpetrators or a possible motive for sabotage. The strategic importance of a project alone is not evidence of a state-sponsored attack.”