Work is resuming at the Fehmarnbelt tunnel, the 18-kilometre submerged road-and-rail link between Denmark and Germany, after a cyberattack hit the construction project, heise online reports. The tunnel is one of Europe's largest civil engineering works: it will replace the ferry crossing between Rødby on the Danish island of Lolland and Puttgarden on the German island of Fehmarn with a ten-minute drive or a seven-minute train ride, and it is currently scheduled to open in 2029.
What the public record does not yet answer is the part that matters to anyone counting on that date: who was behind the intrusion, which systems it reached, and how many days of work it cost. A megaproject of this kind runs on a sprawling and uneven IT estate — BIM models and survey data shared across a border, machine-control systems on the barges that position tunnel elements, document portals for dozens of contractors, and the payroll and site-access systems of the client organisation, the Danish state-owned Femern A/S. An intrusion anywhere along that chain can stop a worksite without ever touching the tunnel itself.
That is the pattern security researchers have repeatedly described in construction. The industry digitised quickly; its supply chain did not digitise at the same speed, and it did not digitise to the same standard. A main contractor can be well defended and still be reached through a subcontractor's shared drive, a single unpatched remote-access appliance, or a credential reused from an earlier breach. Hundreds of organisations hold logins to a project like this by contract, and every one of them is a door.
Why it matters: cross-border infrastructure is also political infrastructure. A delay at Fehmarnbelt is a delay in the Hamburg–Copenhagen corridor, and both governments have staked growth claims on the link. Cyber incidents now belong on the same risk register as weather, geology and financing — and unlike weather, they can be caused by someone.
What to watch: three data points will decide whether this is a footnote or a case study. The length of the stoppage, which the restart announcement implicitly measures. Whether any contractor or personnel data left the network — the difference between an availability incident and a breach with legal consequences under GDPR. And whether the project publishes an account of the entry point. Silence on the third is what turns one incident into the next one.
