Two Attacks, 4,200 Megawatts, One Suspect Still at Large
A single suspect placed homemade launcher devices at three German substations within four days, and by September 5, 2026 the attacks had already knocked roughly 4,200 megawatts of coal-fired capacity offline and forced a safety shutdown at a second plant. On September 1, devices were found at the Preilack substation that feeds LEAG's Jaenschwalde coal plant in Brandenburg: rocket-like devices designed to carry conductive material into extra-high-voltage lines and trigger a short circuit. At least one detonated, and LEAG chief executive Adolf Roesch said the disturbance triggered an automatic safety shutdown of Jaenschwalde's Block B. The same day, at RWE's Bergheim substation near Cologne, similar launcher devices left in a nearby cornfield dropped conductive material onto overhead lines, forcing five coal-fired units offline, about 4,200 megawatts of capacity by RWE's own count.
On September 4, a third set of launcher devices turned up near a substation at Dormagen-Gohr after a pedestrian alerted police; investigators said a link to the Bergheim attack "appears likely." No one was hurt in any of the three incidents, and none caused a wider blackout, but each targeted the same category of exposed infrastructure: overhead extra-high-voltage lines running through open countryside rather than a fenced substation perimeter.
| Date | Location / operator | What happened | Effect |
|---|---|---|---|
| Sep 1, 2026 | Preilack substation (feeds LEAG's Jaenschwalde plant), Brandenburg | Launcher devices fired conductive material into extra-high-voltage lines; at least one detonated | Automatic safety shutdown, Jaenschwalde Block B |
| Sep 1, 2026 | Bergheim substation (RWE), near Cologne | Launcher devices dropped conductive material onto overhead lines, triggering a short circuit | About 4,200 MW (5 coal units) offline |
| Sep 4, 2026 | Dormagen-Gohr substation, near Cologne | Third set of launcher devices found after a pedestrian tip | No damage; devices secured before use |
What One Suspect With Basic Tools Actually Proved
By September 4, 2026, German police had identified a 48-year-old suspect from Gevelsberg, named in press reports as Daniel W., after he sent letters to several newsrooms claiming sole responsibility for the attacks and calling fossil-fuel power generation "a crime." Investigators raided a converted camper van hidden in woods near Niederzier, close to the Hambach lignite mine and roughly 100 kilometers from Gevelsberg, and found explosives at his flat, but the suspect was not in the vehicle and remains at large, believed to be traveling on foot.
Federal Interior Minister Alexander Dobrindt said investigators were treating the case as a possible instance of "climate terrorism." North Rhine-Westphalia's interior minister, Herbert Reul, rejected the suspect's stated justification directly: "it is not the generation of electricity from fossil fuels that is a crime, but attacking critical infrastructure is a crime," he said, adding that the attacks endangered hospital patients and other critical services regardless of the perpetrator's motive.
Strip out the suspect's stated motive and a narrower fact remains: acting alone, with devices built from commodity rocket parts and conductive material rather than any specialized or military-grade hardware, one person took roughly 4,200 megawatts of German coal capacity offline in a single day and stayed ahead of police for four days afterward. That is the real data point for anyone who owns or buys power tied to this kind of infrastructure: the cost of disrupting a high-voltage substation has fallen far below what most operators' cyber-hardening budgets assume, because none of the three incidents involved a network intrusion, a stolen credential, or any digital access at all.
What an Operator or Industrial Buyer Should Ask This Week
The practical question this sequence raises for a grid operator or a large industrial power buyer is not who the suspect turns out to be, but how someone walking up to an overhead line with a handful of launcher devices went undetected at two sites and was only stopped at a third because a pedestrian happened to notice.
Three items belong on this week's agenda rather than next quarter's budget review: whether physical monitoring covers extra-high-voltage line corridors and access roads, not just substation fencing; whether operators in the same region, including LEAG, RWE and transmission operators such as Amprion and TenneT, share detection data in real time, since the Dormagen-Gohr device was found through an outside tip rather than a shared alert after Bergheim; and whether industrial buyers with supply contracts tied to specific coal units have a documented fallback plan for a multi-day capacity loss unrelated to weather or maintenance. None of this depends on classifying the suspect's ideology; it is a physical-security and business-continuity gap that this week's events already priced.
Read next: OpenAI Agents Turned a German Wiki Into Their Own Board | 85% of German Exchange Servers Are Still Open
