DisclosureLens
GLOBALMalwareTransportation & LogisticsTransportationRansomwareBarracudaRansom DemandedActor NamedData Leak ThreatenedMedium

Femern Link Contractors (FLC)

bd_49cda87bdf1bc96d · schema v1 · pii pii-v2

Severity

Medium

Discovered

—

Filed

Oct 28, 2026

To disclose

—

Affected

Not disclosed

Confidence

50%
Full breach record for Femern Link Contractors (FLC) →

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group Barracuda on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: TransportationDiscovered: 2026-10-28

Source: Ransomware.live

Post text · scraped from the leak site

Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work includes the immersed tunnel, tunnel portals and ramps, and the factory that produces the tunnel elements. During the attack, we bypassed EDR and infiltrated infrastructure. Since September 17, 2026, we have had full access to all confidential files of Femern Link Contractors, including internal correspondence, contracts, agreements, insurance documents, tunnel construction photos, site videos, procurement records, bank accounts and balances, employee personal data, and more. After gaining access to all systems, we encrypted all vCenter virtual machines on the day of the attack, resulting in a complete infrastructure shutdown. As a cybersecurity group, we do not wish to harm company and have sought a resolution. In an alternative outcome, this data and incident might never have been published (as with other clients with whom we successfully negotiated). However, due to interference from the Danish police, cooperation was prevented, and Femern Link Contractors will now suffer maximum reputational damage. All confidential construction information will become publicly available, including: C1 - Strategy C2 - QHSE C3 - Risk Management C4 - Compliance & Interface C5 - Project Control P1 - Works Preparation P2 - Design & Engineering P3 - Execution P4 - Completion S1 - Contract Management S2 - Procurement S3 - Human Resources S4 - Admin & Finance S5 - Communication & PR S6 - Information Systems & Document Control S7 - Industrial Relations XX IT - Temporary YY - PointCloud In total, 1,576,452 files and 154,206 folders (2.44 TB) were exfiltrated. The data is available for purchase either as individual files or as the entire dataset. | Status: selling | $500,000

Incident timeline — mostly unverified

? — ?

Breach window unknown

Oct 28, 2026

Claim posted

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Claim → filing

—

Compliance clock

Not assessable

Tracked as a single-filing incident — the only disclosure on record for this event so far.Unverified claimView incident

Evidence ladder

Leak-site claimThis record

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.

Source ceiling

  • actor name
  • victim claim
  • ransom/leak status
  • discovery date
  • materiality
  • notification
  • affected count
  • confirmed data types
  • compliance clock

The ✕ fields stay blank until a regulatory filing or victim disclosure lands.

About this group

barracuda

16 victims claimed globally16 tracked hereFull profile →