Femern Link Contractors Ransomware Claim by Barracuda (Oct 2026)

Claim Summary

The Barracuda ransomware group has allegedly listed Femern Link Contractors (FLC) on its dark web leak site, claiming to have breached the organization’s infrastructure and exfiltrated approximately 2.44 TB of data. According to the threat actor, the attack occurred on October 28, 2026, and involved bypassing endpoint detection and response (EDR) tooling before encrypting vCenter virtual machines.

FLC is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. The group claims to have maintained access to FLC systems since September 17, 2026, and is purportedly selling the full dataset for $500,000. The actor alleges that 1,576,452 files across 154,206 folders were taken.

Notably, the group claims that negotiations were disrupted by “interference from the Danish police,” which it says prevented a resolution. This framing is a common pressure tactic and should be treated with skepticism.

Threat Actor Profile

Barracuda is a ransomware group with limited publicly documented history. At the time of writing, there is no confirmed victim count, no verified tooling inventory, and no public research references available for this actor. This lack of a track record is significant: it means we cannot assess the group’s historical accuracy, technical sophistication, or whether it has previously followed through on data publication threats.

The claim itself references EDR bypass and vCenter encryption, which are common tactics across many ransomware operations. However, without corroborating research, these assertions remain unverified. Analysts should not assume the group possesses the capabilities it describes. No YARA rules or detection guidance specific to this actor are currently available; defenders should rely on general ransomware detection practices, including monitoring for vCenter/ESXi abuse and anomalous data staging.

Alleged Data Exposure

The threat actor claims the stolen data spans a broad range of categories, including internal correspondence, contracts, agreements, insurance documents, construction photos, site videos, procurement records, bank account details, and employee personal data. The group also lists a structured set of project folders covering strategy, QHSE, risk management, compliance, project control, design and engineering, execution, contract management, procurement, human resources, finance, and IT.

If accurate, this would represent a significant exposure of both corporate and personal information. However, Yazoul Security has not seen any samples and cannot confirm the existence, scope, or authenticity of the alleged data. Ransomware groups frequently exaggerate data volumes and sensitivity to increase pressure on victims.

Potential Impact

Should the claims prove accurate, potential impacts could include reputational damage to a high-profile infrastructure project, exposure of commercially sensitive contract and procurement information, and privacy risks for employees whose personal data is allegedly included. The involvement of a cross-border infrastructure project could also raise regulatory and contractual scrutiny.

That said, these are potential consequences only. No impact has been confirmed, and the organization has not publicly validated the claim at the time of writing.

What to Watch For

• Official statements from Femern Link Contractors or its partners.
• Danish or German authorities confirming or denying any investigation.
• Publication of data samples by the group, which would lend credibility to the claim.
• Any regulatory notifications regarding personal data.
• Whether the group’s leak site updates the listing status or removes it, which can indicate negotiation or withdrawal.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Nothing in this article has been independently verified by Yazoul Security. The allegations described are the threat actor’s assertions and should not be treated as fact. No data samples, credentials, or access information are included. Organizations should await official confirmation before drawing conclusions.