Lyce · Hybrid Watch
hw_4d3653e4381b0df2
Russian-linked cyberattack targets a district heating plant in western Sweden.
During spring 2025, attackers targeted the operational systems of a district heating plant in western Sweden. These systems control physical infrastructure, making the incident an attempted disruption of energy operations rather than simply an attack on a public website. A built-in protection mechanism prevented serious consequences. Civil Defence Minister Carl-Oskar Bohlin disclosed the incident on 15 April 2026 and said that Sweden’s intelligence service had investigated and identified the actor responsible. The public reporting does not establish the precise day, the municipality or the plant’s identity. Sveriges Radio Swedish authorities attributed the operation to a pro-Russian group with links to Russian security and intelligence services. This therefore has an official Russian-linked attribution, although the cited account does not identify a particular Russian agency or establish its precise command role. The Atlantic Council places the attempt within a broader pattern of destructive operations against European energy infrastructure. Its publication date, 16 April 2026, should not be used as the incident date.
E/M/R/S scores
- EExistence0/4 · Not assessed
- MIntent0/4 · Not assessed
- RRussian actor link0/4 · Not assessed
- SRussian state responsibility0/4 · Not assessed
Facts
No facts
Sources
-
- Role
- discovery_lead
- Date
- 2025-04-15T08:14:13Z
During spring 2025, attackers targeted the operational systems of a district heating plant in western Sweden. These systems control physical infrastructure, making the incident an attempted disruption of energy operations rather than simply an attack on a public website. A built-in protection mechanism prevented serious consequences. Civil Defence Minister Carl-Oskar Bohlin disclosed the incident on 15 April 2026 and said that Sweden’s intelligence service had investigated and identified the actor responsible. The public reporting does not establish the precise day, the municipality or the plant’s identity. Sveriges Radio Swedish authorities attributed the operation to a pro-Russian group with links to Russian security and intelligence services. This therefore has an official Russian-linked attribution, although the cited account does not identify a particular Russian agency or establish its precise command role. The Atlantic Council places the attempt within a broader pattern of destructive operations against European energy infrastructure. Its publication date, 16 April 2026, should not be used as the incident date.