Femern Link Contractors (FLC), the joint venture building the Fehmarnbelt tunnel between Denmark and Germany, has confirmed that data was stolen in a cyberattack discovered on October 11, 2026. FLC said on October 27 that systems containing personal data were affected, and project owner Femern A/S said the same day that FLC had informed it that data, including personal data, was stolen.
A ransomware group calling itself Barracuda has since claimed responsibility. The group alleges it stole about 2.44 TB of data, or 1,576,452 files in 154,206 folders, and is demanding $500,000. The group is not connected to the security company Barracuda Networks. Its claims have not been independently verified, and FLC had not issued any public statement about the claim at time of publication.
What FLC and Femern A/S have confirmed
In an October 27 update, FLC said: “We confirm that systems containing personal data were affected by the cyber incident.” The company said it has notified those potentially affected and has given employees access to a dedicated legal hotline.
FLC said that after discovering the incident on October 11, it activated its incident response procedures, isolated the affected servers and brought in external cybersecurity specialists. It added that it is handling the situation under data protection rules and in cooperation with the relevant authorities, and that the official investigation is still ongoing.
Femern A/S, part of the Danish state-owned Sund & Bælt group, said in a status update that the attack was directed at FLC’s IT systems and that it has “no indication that Sund & Bælt’s systems were affected.”
FLC has not said how many people are affected or exactly which personal data was taken. Danish media reported that an internal notice to staff listed salary and tax details, bank information, identity documents, health information, employment records and access system data as categories that may have been affected. FLC has declined to comment further on those details.
Construction work disrupted, then resumed
The attack hit overnight into Monday, October 12, and disrupted work at the construction site. According to a Femern A/S press release from October 16, work gradually resumed in several areas, though IT systems at the site were still affected. Earthworks continued on both the Danish and German sides, and the tunnel element production facility in Rødbyhavn was expected to restart shortly.
The attack is being investigated by Denmark’s National Special Crime Unit (NSK). Danish government ministers called the incident serious, and one said it showed how vulnerable a highly digitized country can be to cyberattacks.
The Fehmarnbelt Fixed Link is an 18 km immersed road and rail tunnel and is set to become the longest immersed tunnel in the world. It is one of Europe’s largest infrastructure projects, which makes the theft of its contractor’s internal files more than a routine corporate breach.
What the Barracuda group alleges
On its leak site, the Barracuda group made several claims that BreachNews could not verify. The group alleges that it:
- Had full access to FLC’s confidential files since September 17, 2026, weeks before the attack was discovered
- Bypassed endpoint detection and response (EDR) tools to move through the network
- Encrypted all VMware vCenter virtual machines on the day of the attack, causing a full infrastructure shutdown
- Stole internal correspondence and contracts, along with insurance documents, procurement records, bank account details, construction photos, site videos and employee personal data
The group says the data is for sale as individual files or as a full dataset for $500,000. It also claims that “interference” from Danish police prevented a deal with FLC. BreachNews has not seen or reviewed any of the allegedly stolen data.
If accurate, the timeline would mean the attackers were inside FLC’s network for more than three weeks before deploying ransomware. Long dwell times like this are common in double extortion attacks, where criminals quietly copy data first and then encrypt systems to increase pressure.
Barracuda’s earlier activity
The same Barracuda name appeared earlier this year when the group claimed a 447 GB data leak involving Clinical Associates of the Finger Lakes in New York. The FLC claim would put a major European infrastructure project on the group’s list of alleged victims.
The attack adds to a difficult stretch for Danish organizations. BreachNews recently reported on breaches at the University of Copenhagen and the Technical University of Denmark.
Advice for FLC staff and partners
- Use the legal hotline FLC set up for employees if you received a notice and have questions.
- Watch for targeted phishing that uses project details, invoices or contract names to look legitimate.
- Verify payment changes by phone before acting on any request to update supplier bank details.
- Monitor bank accounts and consider extra checks on your identity documents if you are a current or former employee.
FLC directs media questions to its press contact listed on its website. BreachNews will update this article if FLC or the Danish authorities share more about the scope of the breach or respond to the Barracuda claim.
