Femern Link Contractors (FLC)
bd_49cda87bdf1bc96d · schema v1 · pii pii-v2
Full breach record for Femern Link Contractors (FLC) →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Barracuda on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work includes the immersed tunnel, tunnel portals and ramps, and the factory that produces the tunnel elements. During the attack, we bypassed EDR and infiltrated infrastructure. Since September 17, 2026, we have had full access to all confidential files of Femern Link Contractors, including internal correspondence, contracts, agreements, insurance documents, tunnel construction photos, site videos, procurement records, bank accounts and balances, employee personal data, and more. After gaining access to all systems, we encrypted all vCenter virtual machines on the day of the attack, resulting in a complete infrastructure shutdown. As a cybersecurity group, we do not wish to harm company and have sought a resolution. In an alternative outcome, this data and incident might never have been published (as with other clients with whom we successfully negotiated). However, due to interference from the Danish police, cooperation was prevented, and Femern Link Contractors will now suffer maximum reputational damage. All confidential construction information will become publicly available, including: C1 - Strategy C2 - QHSE C3 - Risk Management C4 - Compliance & Interface C5 - Project Control P1 - Works Preparation P2 - Design & Engineering P3 - Execution P4 - Completion S1 - Contract Management S2 - Procurement S3 - Human Resources S4 - Admin & Finance S5 - Communication & PR S6 - Information Systems & Document Control S7 - Industrial Relations XX IT - Temporary YY - PointCloud In total, 1,576,452 files and 154,206 folders (2.44 TB) were exfiltrated. The data is available for purchase either as individual files or as the entire dataset. | Status: selling | $500,000
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Oct 28, 2026
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.