Femern Link Contractors
Barracuda listed this organization on its leak site on Oct 28, 2026.
- Listing date
- Oct 28, 2026
- Attack date
- Oct 12, 2026
Listing text
Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work includes the immersed tunnel, tunnel portals and ramps, and the factory that produces the tunnel elements. During the attack, we bypassed EDR and infiltrated infrastructure. Since September 17, 2026, we have had full access to all confidential files of Femern Link Contractors, including internal correspondence, contracts, agreements, insurance documents, tunnel construction photos, site videos, procurement records, bank accounts and balances, employee personal data, and more. After gaining access to all systems, we encrypted all vCenter virtual machines on the day of the attack, resulting in a complete infrastructure shutdown. As a cybersecurity group, we do not wish to harm company and have sought a resolution. In an alternative outcome, this data and incident might never have been published (as with other clients with whom we successfully negotiated). However, due to interference from the Danish police, cooperation was prevented, and Femern Link Contractors will now suffer maximum reputational damage. All confidential construction information will become publicly available, including: C1 - Strategy C2 - QHSE C3 - Risk Management C4 - Compliance & Interface C5 - Project Control P1 - Works Preparation P2 - Design & Engineering P3 - Execution P4 - Completion S1 - Contract Management S2 - Procurement S3 - Human Resources S4 - Admin & Finance S5 - Communication & PR S6 - Information Systems & Document Control S7 - Industrial Relations XX IT - Temporary YY - PointCloud In total, 1,576,452 files and 154,206 folders (2.44 TB) were exfiltrated. The data is available for purchase either as individual files or as the entire dataset. | Status: selling | $500,000
In the press
Le principal entrepreneur du projet de la Fehmarn Bält-förbindelsen, FLC (Femern Link Contractors), a été victime d'une intrusion de données. Cette cyberattaque a entraîné la panne des systèmes centraux, provoquant l'arrêt de plusieurs navires et l'interruption du fonctionnement des cartes d'accès. Les problèmes ont débuté la nuit précédant le lundi.
About the group
Barracuda posted its first listing on Aug 6, 2026 and has listed 20 organizations to date.
Learning center
What does this listing mean?
Ransomware groups move data out of the organization before encrypting systems and threaten to publish it if the ransom is not paid. This method is called double extortion.
The listing shows that the group claims to have targeted the organization. Whether the data was published is shown by the later status of the listing.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.