A Barracuda ransomware claim has placed Femern Link Contractors at the centre of a significant cyber incident affecting the Fehmarnbelt tunnel project. Femern A/S has confirmed disruption and data theft, but the identity of the attacker remains unverified.
On 28 October 2026, an outfit calling itself BARRACUDA listed Femern Link Contractors, known as FLC, on its data-leak site. It claimed to have encrypted systems and stolen 2.44 TB of information, although no official source has attributed the attack to this group or validated its detailed allegations.
What happened in the Barracuda ransomware claim?
FLC is the main contractor responsible for designing and building the immersed Fehmarnbelt tunnel between Denmark and Germany. Its internal IT systems were hit by a cyberattack around 11 to 12 October 2026, disrupting work at the major construction site.
Femern A/S, the project owner, first publicly announced the incident on 13 October. A subsequent update identified 11 October as the attack date, while several trade publications described the incident as occurring during the night of 12 October. The slight difference has not been publicly resolved.
The confirmed incident affected FLC’s IT environment and interrupted some site activity. Construction work began to resume gradually from 16 October, indicating that operational recovery was under way while technical and law enforcement investigations continued.
On 27 October, Femern A/S confirmed that information had been stolen from FLC and that the compromised material included personal data. It also said there was no indication that systems belonging to Sund & Bælt, the Danish state-owned infrastructure company associated with the project, had been affected.
The following day, monitors observed the Barracuda ransomware listing naming FLC. The timing connects the leak-site claim to an already confirmed incident, but timing alone does not establish responsibility. Neither FLC, Femern A/S nor Danish law enforcement has publicly named the attacker.
Timeline of the Femern Link Contractors incident
- 11 October 2026: Femern A/S later identifies this as the date of the cyberattack against FLC.
- Night of 12 October 2026: Several industry reports describe the attack as taking place during this period.
- 13 October 2026: Femern A/S issues its first public notice that FLC has experienced a cyber incident.
- 16 October 2026: Work at the Fehmarnbelt construction site begins to resume gradually.
- 27 October 2026: Femern A/S confirms that data, including personal data, was stolen. It reports no indication of compromise within Sund & Bælt’s systems.
- 28 October 2026: The Barracuda ransomware outfit adds FLC to its leak site, and third-party monitoring services record the listing.
Danish police are investigating the incident. As of 28 October, no public law enforcement statement has confirmed the actor’s identity or supported the technical details contained in the leak-site post.
What the alleged attacker claims
The BARRACUDA post alleges that the group had access to FLC’s infrastructure from 17 September 2026. It claims that the attackers bypassed endpoint detection and response controls before encrypting virtual machines through VMware vCenter on the day of the disruptive attack.
If accurate, control of vCenter could have allowed an attacker to affect multiple virtual machines from a central management layer. However, FLC and Femern A/S have not disclosed whether vCenter was involved, which security controls were bypassed, or how the intruders initially entered the environment.
The Barracuda ransomware claim also alleges the theft of 1,576,452 files stored across 154,206 folders, amounting to approximately 2.44 TB. The actor says the material includes internal correspondence, contracts, procurement and insurance records, financial information, employee personal data, construction media, engineering documents and IT records.
These descriptions are consistent with the wide range of information that a large construction joint venture might hold, but that does not make the allegations independently reliable. No verifiable samples were publicly available as of 28 October, and the reported file count and data volume originate solely from the threat actor.
The post reportedly demanded $500,000 and offered the alleged material for sale as separate files or a complete collection. This demand, like the technical narrative and claimed quantity of stolen data, has not been corroborated by the victim, investigators or validated leak evidence.
Confirmed facts versus unverified allegations
The underlying attack is confirmed. FLC’s IT systems were targeted, construction activity was disrupted, and data including personal information was stolen. Those facts are supported by updates from Femern A/S and reporting on the operational response.
The Barracuda ransomware attribution remains an allegation. Persistent access from September, endpoint security bypass, vCenter encryption and theft of exactly 2.44 TB have not been independently established. Listings associated with this actor have also been reported as containing questionable or fabricated victim claims, making careful verification particularly important.
The ransomware actor should not be confused with Barracuda Networks. The cybersecurity company has publicly stated that it has no connection to the criminal operation using the Barracuda name.
Affected systems and current exploitation status
The affected environment consists of FLC’s internal IT systems supporting the Fehmarnbelt project. No specific software products, versions, vulnerabilities, malware family or initial access method have been disclosed by FLC, Femern A/S or investigating authorities.
This is an in-the-wild cyberattack rather than a theoretical vulnerability. Nevertheless, organisations cannot apply an incident-specific patch because no exploited flaw has been identified. No official indicators of compromise have been published, and there is currently no validated technical evidence that would allow defenders to confirm the Barracuda ransomware attribution in their own telemetry.
Why the FLC cyberattack matters
The incident shows how an attack on a principal contractor can disrupt a major cross-border infrastructure project even when the project owner’s wider systems appear unaffected. It also creates potential consequences for employees, subcontractors and suppliers whose personal or commercial information may be present in the stolen data.
UK businesses supporting engineering, marine, construction, staffing, logistics or IT work connected to the project should anticipate possible follow-on phishing. Criminals may reference the Barracuda ransomware claim, changed payment details, recovery activity or supposedly exposed documents to make messages appear credible.
What organisations should do now
- Verify unexpected payment, access or document-sharing requests through a known contact and a separate communication channel.
- Review connections, accounts and file exchanges involving FLC or related project partners, prioritising unusual activity since the confirmed incident period.
- Preserve relevant authentication, endpoint, virtualisation and data-transfer logs in case official indicators become available.
- Prepare to assess exposure if FLC confirms which personal or supplier records were taken.
- Treat leak-site claims as intelligence leads, not proof, until supported by victim statements, law enforcement findings or verifiable data.
The confirmed theft warrants attention, but the Barracuda ransomware narrative should remain clearly separated from established facts. Further findings from FLC, Femern A/S or Danish police will be necessary to determine the entry route, full data impact and identity of the attacker.
Originally reported by redpacketsecurity.com.
