Cyberattack halts work on the Fehmarnbelt tunnel as contractor FLC is hit
A cyber incident at Femern Link Contractors brought construction of the Denmark–Germany Fehmarnbelt tunnel to a standstill at the Rødbyhavn site.
- Victim
- Femern Link Contractors
On 13 October 2026, the Danish state project company Femern A/S confirmed that its main contractor, Femern Link Contractors (FLC) — the international consortium building the immersed sections, portals and related works of the Fehmarnbelt fixed link between Denmark and Germany — had been hit by a cyber incident that brought Denmark's largest infrastructure project to a standstill. According to reporting by the engineering outlet Ingeniøren, FLC's IT systems were struck in the early hours of Monday 12 October, taking several central systems offline.
The disruption was felt directly on the construction site at Rødbyhavn, on the Danish island of Lolland, where the tunnel elements are cast and assembled. Several vessels were reported to be at a standstill and employees were told to stay away from their computers while the contractor worked to understand and contain the incident. The physical construction of the roughly 18-kilometre immersed tunnel — slated to become the world's longest of its kind — paused as a result.
Response and open questions
Femern A/S said it had been informed of the incident by FLC and, as of its initial statements, had no further details to share. Communications director Jens Villemoes of Sund & Bælt, Femern's parent, said the project company was in dialogue with FLC about the situation and had no additional information at that point. Neither the affected systems, the scope of the disruption, nor the identity of whoever was behind the attack had been specified.
Context
The Fehmarnbelt tunnel is a multi-billion-euro, binational megaproject that has already run years behind schedule, and FLC and Femern A/S have been locked in a long-running commercial dispute over the works. No threat actor had claimed responsibility for the incident, and the attack had not been publicly characterised as ransomware. As Danish authorities assessed the event, officials did not rule out a possible link to the broader pattern of cyber threats against European critical infrastructure, though no attribution had been established.
Timeline
The IT systems of main contractor FLC are hit in the early hours of Monday morning; several central systems go down.
Femern A/S and Sund & Bælt confirm the cyber incident; construction at Rødbyhavn is at a standstill, several vessels are stalled, and workers are told to stay off their computers.