IT Outage at the Fehmarnbelt Tunnel Contractor Idled Vessels and Site Access

Overnight into Monday, 12 October 2026, Femern Link Contractors (FLC), the consortium building the Fehmarnbelt tunnel between Denmark and Germany, was hit by a cyberattack on its information technology (IT) systems. The tunnel owner, Sund & Bælt, confirmed the incident. On 27 October 2026 it added that FLC has told it data was stolen in the attack, including personal data. The Danish National Special Crime Unit is investigating, and no one has officially said who was behind it.

What happened on site. The attack was aimed at office IT, but the effects reached the construction work itself. According to the Danish outlet FemernBusiness, employees were told not to connect to Wi-Fi, open their computers or use FLC email, and several site functions were moved to manual. The electronic access card system stopped working normally, so guards registered workers by hand as they came and went, and working hours could not be logged digitally. Several vessels working on the tunnel elements and the tunnel trench sat idle because they depend on digital systems and data to do their work. Polish Radio, citing the Danish newspaper Folketidende, reported that worker identification cards, vessels, cranes and offshore platforms were affected. By 16 October, Sund & Bælt said work had gradually resumed in several areas, with earthworks continuing on both sides and some concrete and steel work under way.

Who is behind it. There is no official attribution. The chairman of Denmark's Council for Digital Security told the broadcaster TV 2 the incident could be linked to hybrid warfare, but that is an opinion and not a finding. We are treating this as an incident with an unknown actor.

What is new. Attacks that start on the office network and stop physical work are not new, but this case shows it clearly in marine construction. The vessels and cranes were not reported as hacked themselves. They stopped because the data and systems they rely on, such as positioning data, work plans and site access, lived on, or passed through, the IT systems that went down. Most plants, ports and terminals have the same hidden dependency, and most have never tested what still runs when the office network is turned off.

Where this shows up from the plant floor to the cloud. On the floor and on the water, equipment such as cranes, dredgers, pumps and process controllers often keeps running on its own but needs files, recipes, schedules or positioning data pushed from a server. In the control room, historians, engineering workstations and alarm systems often share logins, file shares or network services with corporate IT. At the gate, badge and access control systems usually run on the corporate network and its directory of user accounts. In the cloud and the office, timekeeping, payroll and work order systems hold data workers need to keep the job moving.

What it means for owners. If your operations would stop when office IT goes dark, an attacker does not need to touch your control systems to shut you down. That applies to asset owners and to the contractors and integrators working on their sites. For maritime facilities regulated by the U.S. Coast Guard, it also goes straight to the cybersecurity plan and incident response drills the rule expects.

What the Red Tiger team recommends:

1. Map what your operations need from IT. For each critical process, vessel or crane, list the files, data feeds, logins and network services it depends on, and mark which ones live on the corporate network.
2. Separate operations from office IT. Put operational systems on their own network segment with their own accounts, and allow only the few connections they truly need, so an office outage or infection does not spread to them.
3. Keep offline copies and manual procedures. Keep current offline copies of the data operations need, such as positioning files, recipes, drawings and contact lists, and write down how to run access control and timekeeping by hand. Practice it in a drill at least once a year.
4. Hold contractors to the same standard. Ask every contractor and integrator on your site for their incident response plan, how they keep their tools separate from your network, and how fast they will tell you if they are hit or if your data is stolen.

With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners map these IT to operations dependencies with plant-safe methods, design the separation, and run tabletop drills where the office network is assumed to be down.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources:

Sund & Bælt (Femern A/S), "Status: Cyberattack on the main contractor for the Fehmarnbelt project," 27 October 2026: https://femern.com/press/news/status-cyberattack-on-the-main-contractor-for-the-fehmarnbelt-project/

Sund & Bælt (Femern A/S), "Contractor on the Fehmarnbelt project resumes work after cyberattack," 16 October 2026: https://femern.com/press/news/contractor-on-the-fehmarnbelt-project-resumes-work-after-cyberattack/

FemernBusiness, 19 October 2026: https://www.fehmarnbusiness.com/news/cyberattack-hits-fehmarn-construction-project-systems-down-and-operations-affected/5384151

Polish Radio English Section, 14 October 2026: https://www.polskieradio.pl/395/7785/artykul/3742253,major-baltic-sea-tunnel-project-hit-by-cyberattack-reports

TV 2 (Danish), live coverage from 13 October 2026: https://nyheder.tv2.dk/live/samfund/2026-10-13-femern-byggeri-ramt-af-hackerangreb/flere-skibe-staar-stille?entry=fd6f77aa-7d0d-4bee-b863-2da8330f3073

‍