A cyberattack knocked out key IT systems at Femern Link Contractors (FLC), the main contractor building the Fehmarnbelt tunnel, overnight on October 12. The disruption affected construction of the 18-kilometer road and rail link beneath the Baltic Sea.
A week later, reports are shedding more light on the consequences. On October 19, local news outlet FemernBusinessreported that access control systems and parts of the offshore construction operation had also been affected.
Production facility awaited full restart
Project owner Sund & Bælt said on October 16 that several IT systems remained affected. Construction had partially resumed, while the production facility in Rødbyhavn, Denmark, was awaiting a full restart.
Earthworks continued on both the Danish and German sides, alongside some concrete and steel work. The update showed how the impact varied across the project: some activities could proceed while others remained dependent on the recovery of the contractor’s systems.
The tunnel will connect the road and rail networks of Denmark and Germany. Its construction brings together a major production facility, work sites in both countries and offshore operations. Disruption within one contractor’s IT environment therefore had consequences across several parts of the construction process.
Staff reportedly told to keep computers switched off
According to FemernBusiness, employees were instructed to keep computers switched off and avoid using FLC’s email and wireless networks. Some functions were reportedly handled manually.
Those details, including the reported effects on access control and offshore work, come from the outlet’s sources. Sund & Bælt’s public statements confirm broader disruption to IT systems and construction. The precise extent of the effects on those individual operations remains unclear.
National police unit leads investigation
FLC has confirmed the cyberattack and is cooperating with Danish authorities. The investigation is being led by National enhed for Særlig Kriminalitet, Denmark’s national unit for serious crime.
How the attackers gained access, whether data was stolen and whether a ransom was demanded remain open questions. The identity of the attackers and their motive are also unknown.
Discussion about this post