Who Is Attacking Germany’s Power Grid? Twin Sabotage Incidents Trigger Major Investigation

Germany Launches Terror Probe After Explosives Found at Critical Power Infrastructure

Germany’s Under Attack

Germany is investigating two deliberate attacks on its electricity infrastructure after explosive devices were discovered at one substation and another incident forced five major power-station units offline. The attacks happened in different parts of the country within roughly 24 hours, immediately turning what might once have looked like isolated vandalism into a national security problem.

No widespread blackout followed either incident. That may be the most important warning of all: whoever carried out the attacks appears to have been willing to interfere directly with high-voltage infrastructure capable of carrying consequences far beyond the immediate target. German investigators have not publicly identified the perpetrators or established that the two incidents were connected.

Explosives Found Beside a Major Brandenburg Grid Node

The first incident emerged on the morning of September 1 near the Turnow-Preilack substation in Brandenburg, close to the Jänschwalde lignite-fired power station. Police were called at around 8am after suspected damage was discovered on an overhead line.

Investigators found several suspected improvised explosive and incendiary devices at the scene, some of which had not detonated. Brandenburg police said bomb-disposal specialists from the state criminal police office were deployed while officers secured evidence and searched the surrounding area. Authorities said there had been no impact on the wider population.

By September 2, the case had escalated sharply. Brandenburg police said investigations were being conducted on suspicion of disrupting public operations, causing an explosive blast, destroying important equipment and — significantly — forming a terrorist organisation.

That does not mean police have established that a terrorist group carried out the attack. It means the evidence is serious enough for investigators to examine that possibility while the perpetrator, organisation and motive remain unknown. Police have restricted further disclosure to avoid compromising the investigation.

Then Another Electricity Site Was Hit Hundreds of Miles Away

Hours later, another disturbance struck the electricity network around Bergheim, west of Cologne in North Rhine-Westphalia. Authorities concluded that the incident did not appear to have been caused by a technical malfunction.

Investigators found six launching devices in a nearby field. Officials said the equipment appeared designed to use pyrotechnic devices to lift conductive material or wire across overhead electricity lines, creating a short circuit.

The consequences were substantial even though homes and businesses continued receiving electricity. Five lignite-fired generating units connected to the regional system went offline, representing approximately 4,200 megawatts of generating capacity.

Grid stability was maintained and Germany avoided the sort of cascading failure that could have turned the attack into a far more serious public emergency. Several units subsequently began returning to operation, with the remaining capacity expected to be restored.

North Rhine-Westphalia Interior Minister Herbert Reul described the evidence as creating an initial suspicion of anti-constitutional sabotage. Investigators are examining possible foreign-directed sabotage as well as left-wing extremism, but neither theory has been established as the explanation.

Two Attacks Create a Much Bigger Question

One attack on a power facility can be treated as a local security investigation. Two deliberate attacks on electricity infrastructure on opposite sides of Germany within roughly a day force investigators to confront a more uncomfortable possibility.

Authorities are examining whether there is any connection between the incidents. The apparent methods were not identical, and there is currently no public evidence proving that the same people organised both operations.

But the timing alone raises the stakes.

Critical electricity infrastructure is not simply another industrial target. Substations sit at the junction between power generation, transmission and distribution. Damaging the right component at the right moment can remove generating capacity, isolate transmission routes and force operators to reroute electricity through the wider network.

Modern grids are designed with redundancy precisely because individual pieces can fail. Sabotage changes the calculation because the failure is no longer random.

An attacker can choose the location.

An attacker can choose the time.

And an attacker with sufficient technical knowledge may choose a point where several vulnerabilities intersect.

Germany Is Already Living With Hybrid-Warfare Fears

The investigations arrive as Germany and other European governments increasingly treat critical infrastructure as part of a much larger security battlefield.

Electricity networks, telecommunications cables, railway systems, ports, airports, logistics hubs and digital networks have become attractive targets because disruption can impose economic and political costs without requiring a conventional military attack.

That strategic uncertainty is what makes hybrid warfare difficult to counter. An identifiable missile crossing a border creates a relatively clear security event. A sabotaged cable, burning electricity pylon, unexplained drone or damaged substation creates an attribution problem first.

Germany is already operating in that environment. European states have repeatedly strengthened protection around energy and transport infrastructure as governments confront cyberattacks, espionage, sabotage attempts and other forms of pressure that can remain below the threshold of open warfare.

The wider danger mirrors the growing threat to European power plants, energy links and other critical infrastructure, where the question is increasingly not simply whether an attack can be stopped, but how quickly states can determine who actually carried it out.

Russia Cannot Simply Be Blamed Without Evidence

Foreign involvement will inevitably attract attention because Germany has accused Russia of conducting or sponsoring hybrid activity across Europe and because Berlin remains one of Ukraine's most important supporters.

That context matters. It is not evidence that Russia carried out these attacks.

Brandenburg Interior Minister Jan Redmann has said foreign involvement cannot be ruled out, while investigators have also considered domestic extremist possibilities. No public evidence currently establishes Russian responsibility, and no identified foreign government has been tied to either power-grid incident.

That distinction is essential. Hybrid warfare works partly through uncertainty, and prematurely assigning responsibility can be almost as strategically dangerous as ignoring genuine hostile activity.

Germany therefore faces two simultaneous jobs: finding the people who physically carried out the attacks and establishing whether anybody else directed, financed, encouraged or supported them.

The broader European struggle with Russian-linked cyber and hybrid threats explains why investigators will examine the foreign-state theory aggressively. It does not predetermine what they will find.

The Most Important Detail Is That Germany’s Grid Survived

Neither incident produced the nightmare scenario.

There was no nationwide blackout. Electricity supplies to the public remained stable. Grid operators absorbed the loss of generation and prevented the disruption spreading through the system.

That is evidence of resilience.

It is also a warning about what may happen when attackers learn from failure.

The Brandenburg devices did not produce a major outage. The Bergheim attack removed thousands of megawatts of generating capacity but failed to disrupt public supply. If either operation was intended to cause wider disruption, it did not achieve its maximum potential effect.

Investigators will now want to know whether those failures were accidental, whether the attacks were deliberately limited, or whether the objective was simply to prove that strategically important infrastructure could be reached.

Those possibilities lead to very different conclusions.

What Happens Next

German police are continuing forensic searches around the affected infrastructure while investigators reconstruct the devices, materials, access routes and technical methods involved.

The physical evidence could be crucial. Components, explosives, launch mechanisms, fingerprints, DNA, surveillance footage, vehicle movements and communications data may help determine whether the attacks were improvised locally or planned by people with specialist knowledge.

Investigators will also examine whether the near-simultaneous incidents share personnel, equipment, communications or ideological motivation. Until that work produces evidence, suggestions of a coordinated campaign remain exactly that: a possibility.

But Germany has already crossed an important threshold.

This is no longer a theoretical conversation about whether critical infrastructure might become a target. Explosive devices were found beside a major electricity installation, another deliberate attack disrupted high-voltage infrastructure hundreds of miles away, and thousands of megawatts of generating capacity disappeared from the network in seconds.

The grid held.

The next question is whether Germany can identify who tested it — before somebody tries again.