Cyber incident at Fehmarnbelt tunnel construction: IT system failures at contractor FLC

On 13 October, a cybersecurity-related incident occurred at the construction site of the Fehmarnbelt undersea tunnel, located in Denmark. According to local media reports, the attack resulted in the loss of access to key systems of the main contractor, the international consortium Femern Link Contractors (FLC). This project involves the creation of a transport corridor between Denmark and Germany, which draws attention to the vulnerability of strategic facilities that rely not only on physical protection but also on the stable operation of digital infrastructure.

Confirmation of the incident and initial details

Information regarding the system malfunction was released by the Danish state-owned company Sund & Bælt, which is the project client. The company's press secretary, Jens Villemoes, confirmed that the contractor had reported a cyber incident, and that Sund & Bælt representatives are maintaining constant contact with them. At the time of the official statement's publication, no additional details regarding the nature of the attack were provided.

Impact on construction site operations

According to Danish and German media, the cyber incident caused problems with access to the company's internal resources. Specifically, disruptions were recorded in the functioning of electronic passes, computer equipment, and other digital services. The Danish newspaper Lolland-Falsters Folketidende noted a general disruption of work processes at the site.

German public broadcaster NDR, citing Danish television channel TV 2, reported that perpetrators may have exploited a vulnerability in the security system to penetrate IT networks. However, official confirmation of the specific attack method has not yet emerged. There is also no confirmed data on who is behind this incident: it is not linked to any state, hacker group, or other actors.

Project significance and government reaction

The Fehmarnbelt tunnel is set to connect the Danish town of Rødbyhavn with the German town of Puttgarden, passing under the Baltic Sea. Its total length will be approximately 18 kilometres. The infrastructure project includes both road lanes and railway tracks, which is expected to reduce travel time between the two countries.

Construction of this scale requires complex coordination of a large amount of equipment, personnel, and maritime operations. Therefore, even without physical damage to equipment or structures, the disruption of digital systems can seriously complicate the progress of work. Currently, there is insufficient information to determine the full scale of the incident's impact on the construction schedule.

This situation raises questions about the distribution of cybersecurity responsibility in projects where a state client cooperates with private international contractors. The protection of such facilities depends not only on the owner's systems but also on the security level of the networks and digital tools of all involved companies.

Against the backdrop of the incident, Danish Minister for Public Security and Crisis Preparedness Lisbeth Beh-Nielsen stated the need to discuss measures to strengthen the country's digital resilience. At the same time, she emphasised that it is too early to draw final conclusions regarding this specific case, as the circumstances are still under investigation. This was reported by the Danish publication DK Nyt, citing Ritzau.