Sweden has publicly blamed a pro-Russian hacking group with links to Russian intelligence and security services for attempting to disrupt a thermal power plant in western Sweden in spring 2025, marking the country’s first public disclosure of the incident. The attack failed due to a built-in protection mechanism, but officials say it reflects a more dangerous phase of Russian hybrid operations targeting European critical infrastructure.
TL;DR
- Sweden said a pro-Russian group targeted a thermal plant in western Sweden in spring 2025
- Officials linked the attackers to Russian intelligence and security services
- The attack failed due to built-in protection mechanisms at the plant
- Sweden warns of increasingly destructive cyberattacks across Europe
What Happened?
Sweden’s Minister for Civil Defence, Carl-Oskar Bohlin, said at a press conference on April 15, 2026 that a pro-Russian cyber group attempted to disrupt operations at a thermal power plant in western Sweden during spring 2025. He did not identify the facility by name, but said the case was handled by the Swedish Security Police, which identified threat actor with connections to Russian intelligence and security services.
According to Bohlin, the attack did not lead to serious consequences because of a built-in protection mechanism at the plant. The government has not released technical details, but described the incident as an attempt to cause real-world disruption, not just a nuisance-level cyberattack.
Why Sweden Says This Matters?
Bohlin said pro-Russian groups that previously focused on denial-of-service attacks are now attempting destructive cyberattacks against organizations in Europe. He also described Russian hybrid attacks as becoming more frequent since Moscow’s invasion of Ukraine.
Sweden linked the attempted attack to a broader pattern across Europe, including similar incidents targeting energy infrastructure in countries such as Poland. Officials across multiple European nations have warned of rising threats to critical systems.
What Did Russia Say?
Russia’s embassy in Stockholm rejected the allegations, calling them unfounded and based on speculative reasoning. The Russian government did not provide further detailed response to the claims.
Topics for more insights:
- An Introductory Guide About Cyber Protection
- Cybersecurity Challenges In 5G Networks
- How Will Cybersecurity Evolve In 2026?
Why This Is Bigger Than One Plant?
The incident highlights how cyberattacks on operational technology and energy infrastructure are increasingly viewed as part of broader geopolitical strategies. Sweden’s public attribution signals a shift toward transparency and warning, as governments aim to prepare industries for more advanced and potentially destructive cyber threats.
The case also underscores the importance of built-in industrial safeguards, which played a critical role in preventing disruption, suggesting that resilience within systems is becoming just as important as perimeter cybersecurity.
Join The Discussion