A series of suspected sabotage attacks against Germany’s electricity infrastructure has expanded into a broader cross-border security investigation after German police arrested a 48-year-old man accused of targeting power facilities in several states.
The case began with incidents in early September involving high-voltage infrastructure in Brandenburg and North Rhine-Westphalia. Authorities subsequently linked the suspect to additional attempted attacks in Saxony and discovered evidence suggesting that further targets may have been considered, including an electricity substation in the Netherlands.
German police arrested the man, identified under German privacy rules as Daniel V., near the Weisweiler power plant in North Rhine-Westphalia on September 8. He was reportedly carrying explosive devices when detained. Police also found a tent nearby containing additional explosive material, which bomb-disposal specialists were examining. Investigators continued searching the surrounding area for possible additional devices and launch equipment.
The arrest followed several days of searches across western Germany. Police had been looking for V. after receiving handwritten letters in which he claimed responsibility for attacks on electricity infrastructure and described opposition to fossil-fuel generation as his motivation. In the letters, he argued that fossil-fuel electricity production causes severe harm and said he had felt compelled to intervene because he believed authorities and the media were not doing enough. He also stated that he had prepared the operations himself.
Attacks across several German states
One of the first incidents occurred near the Jänschwalde coal-fired power plant in Brandenburg. At the Turnow-Preilack substation, investigators found more than a dozen improvised devices apparently designed to direct conductive material toward high-voltage lines.
Two attempts succeeded in causing short circuits. The resulting disruption did not produce a regional blackout, but one of the power plant’s units temporarily shut down automatically. The wider electricity supply remained stable because other generating capacity and the transmission network continued operating.
The incidents were described by Brandenburg officials as deliberate sabotage rather than accidental damage. Investigators initially did not know who was responsible and examined several possible motives, including political extremism and potential involvement by foreign actors.
A separate incident occurred at a substation in Bergheim near Cologne. A short circuit there reportedly caused five power-generation units to be taken offline. Another suspected sabotage attempt was discovered in Dormagen, south of Düsseldorf, where police found equipment including pipes, cables and timers directed toward a substation.
Authorities also reported suspected attacks or preparations in Saxony. Explosive or incendiary devices were found near electricity infrastructure in the Görlitz area, close to the Brandenburg border and the Lusatian lignite-mining region. Investigators have cautioned that the evidence does not automatically establish that V. was responsible for every incident under investigation.
Hybrid warfare is targeting the heart of Europe’s power grid
Multiple sabotage attempts in Brandenburg have targeted 50Hertz high-voltage infrastructure using double-digit explosive projectiles. A 500MW power plant unit was forced offline.
A thread 🧵🇩🇪⚡️👇 pic.twitter.com/sr8TDGZRQf
— Francesco Sassi (@Frank_Stones) September 2, 2026
A possible Dutch target
The investigation took on an international dimension after forensic investigators reportedly examined a converted camper associated with V. and found a notebook containing plans for possible future attacks.
According to reporting by the Frankfurter Allgemeine Zeitung, the notebook listed an electricity substation near Doetinchem in the Netherlands as a potential target. The facility, operated by TenneT at Langerak, is an important high-voltage connection point linking the Dutch national and regional grids and also connecting the Netherlands with Germany.
Dutch authorities said they were not previously aware of the information concerning the alleged target. The discovery therefore appears to concern a planned or contemplated attack rather than an attack that actually took place.
The Langerak facility is also part of the Netherlands’ broader effort to expand electricity-transmission capacity and address grid congestion. Its cross-border connection makes it significant not only for the Dutch electricity system but also for the wider regional network.
From suspected hybrid attack to domestic extremist investigation
The initial uncertainty over the perpetrators reflected the wider security environment in Germany. With critical infrastructure increasingly regarded as a potential target for hybrid operations, authorities initially did not exclude foreign-state involvement or extremist groups.
That assessment has shifted as investigators have gathered evidence pointing toward an individual motivated by opposition to fossil fuels. German Interior Minister Alexander Dobrindt described the case as likely involving “climate extremism,” while authorities continued to examine whether the suspect acted alone or had assistance from others.
Following the arrest, North Rhine-Westphalia Interior Minister Herbert Reul said the available evidence at that stage pointed toward V. having acted alone. That assessment remains part of an ongoing investigation rather than a final judicial determination.
German prosecutors are investigating suspected offenses including causing explosions and disrupting public utilities. Investigators in Brandenburg have also examined the possibility of more serious charges connected with the organization of attacks against critical infrastructure.
A wider vulnerability for Europe’s electricity networks
The incidents illustrate a different category of threat to Europe’s energy system from the cyberattacks and state-sponsored operations that have dominated recent discussions about critical infrastructure.
The alleged method relied on relatively simple physical devices designed to interfere directly with high-voltage transmission equipment. Although the attacks did not cause a large-scale blackout, they demonstrated how attempts to disrupt individual components can produce temporary outages at power-generation facilities and force grid operators to respond rapidly.
Germany’s electricity network is undergoing significant structural change as renewable generation expands and coal-fired capacity is progressively retired. That transition increases the importance of transmission infrastructure, interconnections and system flexibility.
The suspected plot also demonstrates the potential cross-border dimension of physical infrastructure threats. Electricity networks do not stop at national borders, and substations such as the one near Doetinchem form part of interconnected systems spanning Germany, the Netherlands and the wider European grid.
At the same time, the evidence currently available points to an alleged individual campaign motivated by opposition to fossil fuels rather than an established state-directed operation. The discovery of a possible Dutch target broadens the geographical scope of the investigation, but it does not by itself establish that an international sabotage campaign was underway.
The arrest of the German suspect is therefore an important development, but significant questions remain. Investigators still have to establish which attacks can be attributed to him, whether anyone assisted him, what his precise plans were, and whether the material found in his possession was connected to all of the incidents under investigation.
For European energy-security authorities, however, the case highlights a broader issue: the physical protection of electricity infrastructure is becoming increasingly important as power networks become more interconnected and more central to economic and national security.