Coordinated sabotage attacks on the German electricity transmission network temporarily removed roughly 4,200 megawatts of coal-fired generation capacity from service during the first days of September 2026. Despite the scale of the interruption, the national grid remained stable and household supply was not interrupted. The incidents highlight vulnerabilities in physical infrastructure that persist even as digital security receives significant attention.
Amprion confirmed an incident affecting power plant supply lines which resulted in facility outages at RWE Power. The operator took five lignite blocks at Neurath and Niederaußem offline following the disturbances. At the time of the incident, these blocks were feeding approximately 3,000 megawatts into the grid. The discrepancy between total capacity and actual feed-in reflects normal operational variations.
Mechanics of the interruption
The attacks occurred on 1 and 2 September 2026 across two federal states. Confirmed strikes took place at the Brandenburg site of Turnow-Preilack near the Jänschwalde lignite power plant. A second incident struck the Amprion substation at Rommerskirchen in the Bergheim district of North-Rhine-Westphalia. Perpetrators employed self-built launching devices to project wires onto high-voltage equipment.
This method bypasses the need for explosives while achieving similar disruption. Conductive wires thrown over substations cause short circuits that trigger automatic safety mechanisms. The grid is designed to isolate faults rapidly to prevent cascading failures. In this instance, the protection systems functioned as intended, separating the affected sections from the wider network to maintain overall stability.
Grid resilience under pressure
General electricity supply remained stable in both cases. The redundancy built into the European transmission network allowed other generators to compensate for the lost output without requiring emergency load shedding. This outcome demonstrates the robustness of current grid architecture against sudden generation losses. However, it also exposes the reliance on automatic systems to manage physical attacks on critical nodes.
Security experts note that low-tech threats often evade high-tech defenses. Physical perimeter security at substations varies by location and operator. The use of simple projectile devices suggests attackers studied the infrastructure to identify weak points. Energy security protocols typically focus on supply diversification, yet physical hardening remains equally vital for system integrity.
Assets affected and restoration
RWE Power operates the affected lignite blocks in North-Rhine-Westphalia. Neurath and Niederaußem are among the largest coal-fired power stations in Europe. Two units, specifically Neurath G and Niederaußem H, were restarted by the morning of 2 September. These two units represent a combined capacity of roughly 1,600 megawatts. Full restoration of the remaining blocks depended on damage assessments at the substations.
The timing of the attacks coincides with ongoing debates regarding grid resilience and renewable integration in Germany. As coal capacity is phased out under national climate targets, the remaining plants carry higher individual significance for baseline load. Losing 3,000 megawatts of actual feed-in represents a substantial shock, equivalent to the output of several large offshore wind farms operating at full capacity.
Implications for infrastructure policy
The incidents underscore the challenge of protecting dispersed infrastructure. High-voltage substations cover large areas and cannot be easily sealed against projectile attacks. Operators must balance security costs against operational budgets. Regulatory frameworks often mandate reliability standards but leave specific security measures to company discretion. This gap may require revision if such attacks become more frequent.
Police investigations are ongoing to identify those responsible. The coordination required to strike two distant locations within 24 hours suggests organised planning. Authorities treat such acts as serious threats to public safety. The energy sector works closely with security services to share intelligence on potential targets. Future investments may prioritise physical barriers alongside digital monitoring systems.
Organisations
RWE Power · Amprion · 50Hertz
