Femern Link Contractors · Breach

Fehmarnbelt tunnel contractor confirms data theft; Barracuda claims attack

Oct 28, 2026 · 1 min read

Femern Link Contractors (FLC), the joint venture building the Fehmarnbelt undersea tunnel between Denmark and Germany, confirmed an attack discovered on Oct 11, with affected servers isolated. On Oct 27, FLC confirmed that systems holding personal data were affected, and project owner Femern (Sund & Bælt) said data was stolen, including personal data. The Barracuda gang listed FLC on its leak site without showing a data size or sample, and its attribution has not been independently verified; notified current and former staff should protect themselves against targeted phishing and identity fraud.

By HIFY Radar newsroom Updated 10/28/2026 10:22 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Barracuda ransomware gang listed Femern Link Contractors (FLC), the joint venture building the Fehmarnbelt undersea tunnel between Denmark and Germany, on its leak site. FLC itself confirmed the attack, discovered on Oct 11, with affected servers isolated and outside specialists brought in. On Oct 27, FLC confirmed that systems holding personal data were affected, and project owner Femern (Sund & Bælt) said data was stolen, including personal data.

Why it matters

Danish local media report that payroll, tax, bank, ID document, health and access-system data may be involved. FLC has notified potentially affected current and former employees, who face targeted phishing and identity fraud. This is Europe's largest infrastructure build, and an earlier attack halted work at the Rødbyhavn site.

What to do

Brief current and former staff on targeted phishing and identity fraud and monitor misuse of the exposed data. Keep affected servers isolated until the investigation with outside specialists is complete.

For the technical team

Affected: Femern Link Contractors (FLC) Rede de TI da Femern Link Contractors (FLC), consórcio que constrói o túnel submerso Fehmarnbelt entre Dinamarca e Alema · IT network and servers of Femern Link Contractors (FLC), including systems holding personal data. Femern (Sund & Bælt) says it has no indication its own systems were hit.
Exploitation: Attack confirmed by the victim and discovered on Oct 11. The Barracuda gang listed FLC on its leak site without showing a data size or sample; attribution to the gang has not been independently verified, according to DailyDarkWeb.
Fix: No patch applicable. Affected servers isolated and outside specialists brought in by FLC.
More details: Timeline: incident discovered on Oct 11; systems holding personal data confirmed affected on Oct 27. Femern (Sund & Bælt) said data was stolen. FLC has notified potentially affected employees and set up a legal hotline. Danish local media report payroll, tax, bank, ID document, health and access-system data may be involved. DailyDarkWeb analyst note: an earlier attack halted work at the Rødbyhavn site.