Cyberattack halts Fehmarn Belt tunnel construction between Denmark and Germany

Attack stops work on Fehmarn Belt tunnel

Construction of the Fehmarn Belt tunnel, the road-and-rail link being built between Denmark and Germany, has come to a complete halt after a cyberattack struck the consortium carrying out the work. According to RMF24, the incident hit the international FLC consortium, and its consequences were felt directly on the ground: workers' identification cards stopped functioning, and the vessels, cranes and platforms used for offshore operations were immobilized. Danish media report that building activity has stopped entirely as a result.

A cross-border workforce affected

The FLC consortium employs around 2,800 people from companies based in Denmark, Germany, France, Belgium and the Netherlands, and the report notes that a significant number of Polish workers are among the site's staff. Sund & Baelt, the investor behind the project, has confirmed that it is in discussions with the contractor about the situation. As of the report, however, neither the perpetrator of the attack nor the time needed to resolve its consequences had been established, and the exact nature of the intrusion has not been disclosed.

Hybrid warfare not ruled out

Speaking about the incident, Henning Mortensen, head of the Danish Council for Digital Security, did not rule out a connection to hybrid warfare. The remarks come against a tense backdrop: in recent weeks Danish services have warned of possible cyberattacks originating from Russia and have raised the country's threat level to high. No attribution for the tunnel attack has been made.

A megaproject that runs on software

The tunnel itself is a digitally dependent undertaking. The 18-kilometre link is being built from 89 concrete elements that are transported out to sea and connected using digital software, which means the project's physical progress is tied directly to the availability and integrity of its IT systems. The tunnel's cost is estimated at approximately €7 billion, and its opening was originally planned for 2029, although possible delays had already been reported before this incident.

Why it matters

The episode is a concrete illustration of how operational technology has become a single point of failure for physical work. One intrusion at a contractor did not merely steal data or encrypt files — it left cranes idle, ships unable to operate and thousands of workers locked out of a major European construction site. That matters for three reasons. First, it shows the attack surface of large infrastructure projects extends well beyond the owner or operator: here the investor, Sund & Baelt, was not the reported target, but its schedule suffers because its contractor was hit. Second, the construction method itself depends on software, so disruption in the digital layer translates immediately into lost physical progress on a €7 billion project that was already at risk of delay. Third, the context is hard to ignore. Denmark has raised its cyber threat level to high amid warnings about possible Russian attacks, and a senior Danish security official has openly raised the possibility of hybrid warfare. If critical infrastructure can be paused with relative ease at the contractor level, every large build in Europe becomes a potential target, and construction firms — not usually treated as frontline cyber defenders — may need to be.