Turnow-Preilack: a substation hit, and no agreement on what with
A double-digit number of improvised explosive and incendiary devices were found at an electricity substation in Brandenburg on the morning of Tuesday 1 September. Conductive material had been introduced into high-voltage lines in two places, a fireball was seen at about 07:30, and one 500-megawatt block at the neighbouring Jaenschwalde power plant shut itself down. No wider outage followed and nobody was hurt.
Three official voices describe the devices three different ways. The grid operator called them self-built flying objects resembling commercial fireworks. Brandenburg's interior minister called them rockets made for the purpose. The police said plainly that these were not rockets. The international framing settled on the most alarming of the three, and the description drives everything that follows from it.
↓ Download one-page brief (PDF) ↓ Download update brief (PDF, 2 September 2026)↓ Download update brief (9 September 2026)About 07:30 - a fireball at the substation
A fireball is observed at Turnow-Preilack, consistent with a short circuit on the high-voltage side. In two places conductive material had been introduced into the lines.
Block B shuts itself down
Leag reports a technical failure of Block B at the Jaenschwalde plant, one of four 500-megawatt blocks. This is an automatic protective response to a fault on the network, not damage to the plant, which was not itself struck.
About 08:00 - the devices are found
A double-digit number of unexploded improvised explosive and incendiary devices are discovered at the site. Explosives officers attend and the area is secured.
The grid holds
50Hertz restores all affected lines and states that the general power supply was not affected at any point. There is no wider outage and no injuries.
The case goes to the LKA, and the descriptions diverge
The Brandenburg State Criminal Police Office takes over from the Cottbus directorate. 50Hertz calls the devices self-built flying objects resembling commercial fireworks; Interior Minister Jan Redmann calls them rockets made for the purpose; police tell reporters they are not talking about rockets and use the standard term for an improvised explosive and incendiary device.
Officials keep the field open
Minister-President Dietmar Woidke calls it an attempted attack and says the frequency of such incidents means infrastructure must be resolutely protected, promising to pursue those responsible with the full force of the law. Redmann says the investigation runs in all directions. Left-extremist groups historically active in the region are noted, and foreign powers are not excluded.
Vulkangruppe and the Berlin power lines
The far-left Vulkangruppe claimed arson attacks on electricity infrastructure near Berlin, reported as cutting supply to around 45,000 households. This is why domestic left-wing extremism is a live line of enquiry here rather than a token one.
Berlin attributes a drone incident to Russia
The German government formally attributed the 4 August drone incident at Leipzig/Halle Airport to Russia on the same day the substation devices were found. That is context for the public reaction, not evidence about this site.
Turnow-Preilack
Devices at the substation, conductive material in the lines, one block offline, no outage. Unattributed, and the LKA has named no line of enquiry as primary.
The region supports two opposite readings and the investigators have committed to neither. A claimed left-extremist precedent exists a few months back and a formal state attribution landed the same day. Reaching for either explanation here means choosing which coincidence to believe.
That this was deliberate is not in doubt
A double-digit number of improvised devices, conductive material introduced into high-voltage lines in two separate places, and a short circuit at a substation feeding a major generating plant. It is almost certain that this was a deliberate attack on the transmission network. Nothing else accounts for the count of devices or for the placement.
Who did it is genuinely open, and the official language says so
Redmann has said the investigation runs in all directions and has not excluded foreign powers. No group has claimed it, unusually for the left-extremist precedent in this region, which claimed its January attacks. The absence of a claim is the one point that sits awkwardly with the domestic hypothesis: the group active in this region announces its work, and nobody has announced this. Set against a sustained campaign of sabotage against European infrastructure and defence industry, it is a realistic possibility that this attack was directed and enabled by a hostile state. It is not more than that on the evidence published so far, because the LKA has named no line of enquiry as primary and a domestic precedent exists a few months old.
The device description is contested at source, and that matters operationally
Fireworks modified to reach an overhead line, and purpose-built rockets, imply different levels of preparation, different procurement trails and different standoff distances. The police rejection of the word rocket is the most conservative of the three descriptions and comes from the organisation holding the evidence. Until the LKA describes the devices, no inference about capability should be drawn from any of the three accounts.
The method chose a real weakness and the grid, not the site, covered it
Overhead extra-high-voltage lines at a rural substation cannot be hardened the way a control building can, and shorting them requires no access to anything protected. The attack failed against network resilience and generation margin rather than against site security. An operator reading this as a security success has read it backwards.
Where this goes
Substations, pylons and transmission lines have been attacked repeatedly across Europe through 2025 and 2026, and eastern Germany has featured more than once this year. It is highly likely that further attacks on European grid nodes follow, and a realistic possibility that a subsequent attempt succeeds in causing an area outage, because the difference here was margin and speed of restoration rather than prevention. Whether attribution in this case ever becomes public is a separate question, and it is unlikely to be resolved quickly on the evidence described so far.
Set this beside the intrusion at a Polish combined heat and power plant, where the route in was a network and the effect was sought through operational technology. Here the route was a fence line and a length of conductive material. The same outcome was being pursued through the cheapest available means in each case, and the cheaper of the two needs no specialist skills at all.
- Treat overhead lines as part of the site, not as something the grid owns. The attack never entered a building. Anyone reviewing a substation should walk the approach to the line spans, not the fence around the compound.
- Ask what your automatic protection will do, and who will notice. A block tripped itself offline here and that was the system working. Know in advance which of your plant will drop out on a network fault and what the restart looks like.
- Do not read a device count as a capability. A double-digit number of devices were recovered unexploded. That says as much about reliability as it does about intent, and the official descriptions of what they were do not agree.
- Hold the line on attribution in your own reporting. Two opposite explanations are live, one domestic and one foreign, and the investigators have named neither. Briefing either one now creates a correction later.
- Expect the alarming version to travel. The word rocket carried this story worldwide from one of three official accounts. If you brief from headlines rather than from the police statement, you will brief the version chosen for its impact.
- Assume the next one is aimed at the same weakness. Rural transmission infrastructure is unlit, unmanned and reachable, and the method used here needs no access to anything secured. Protection effort should follow that reasoning rather than the perimeter it is easiest to inspect.
- zdfheute.de (Dormagen, 4 Sep 2026)
- tagesspiegel.de (claim letters and manhunt)
- zdfheute.de (searches and the site list)
- taz.de (arrest and claim letter, 8 Sep 2026)
- tagesspiegel.de (arrest and Reul, 8 Sep 2026)
- ad-hoc-news.de / dpa (Schuster, 9 Sep 2026)
This report opened on two attacked substations with no claim, no arrest and two candidate attribution sets - a foreign intelligence service or the domestic far left. In eight days it has acquired a third site, two claim letters, a national manhunt and a man in custody who wrote to newspapers saying that generating electricity from fossil fuels is a crime. The leading line has moved decisively towards a domestic single-issue actor, and it has not been closed.
1. A third site: Dormagen, 3 September
On the evening of Thursday 3 September a passer-by found a suspicious object at the electricity substation at Dormagen, between Cologne and Duesseldorf. Police described it as what appeared to be a launch device, and a spokesperson said that someone had apparently tried to cause a short circuit deliberately. It was found before use. No damage and no outage. Police said that apart from Bergheim no damage had been established at any of the sites.
2. The first claim of responsibility in this whole European wave
Two handwritten letters went to German newsrooms, among them taz and the Frankfurter Allgemeine Zeitung. They contained operational detail that had not been published. One of them says: “Stromerzeugung aus fossilen Brennstoffen ist ein Verbrechen” - generating electricity from fossil fuels is a crime. Another, received by taz, says the use of fossil fuels causes immeasurable suffering. The federal interior minister, Alexander Dobrindt, said the letters showed eindeutiges Taeterwissen, unambiguous perpetrator knowledge.
3. A manhunt, a truck in a forest, and a house in Gevelsberg
Police searched an 8.2-tonne converted truck in North Rhine-Westphalia that the suspect is said to have lived in and planned from, and special forces searched a house in Gevelsberg, where explosives were found. He was at neither. Brandenburg's state criminal police stood up a task force of some 300 officers searching along the power lines. The NRW interior minister, Herbert Reul, said plainly: “Wir wissen nicht wo er sich rumtreibt” - we do not know where he is knocking about.
4. Arrested on 8 September, still carrying explosives
A 48-year-old man, named in German reporting as Daniel V. and resident at Gevelsberg, was stopped near the Weisweiler power plant at Eschweiler, near Aachen, on the morning of Tuesday 8 September. He was carrying further explosives and offered no resistance. A tent in undergrowth nearby held more devices, and further launch mechanisms were found by the high-voltage lines at Weisweiler with another claim letter. Reul's assessment of him was short: “Der war immer noch unterwegs und wollte weitermachen” - he was still out there and wanted to carry on.
5. The method, now described
Reporting describes homemade rocket-type devices that fire conductive wire across high-voltage lines to short them - which is what this report recorded at Turnow-Preilack as conductive material laid into the lines, and what the Dormagen device appears to have been built to do. ZDF reports that 23 rockets were aimed at the Brandenburg site and only one functioned. On the published record the campaign produced no successful blackout anywhere.
6. Two ministers, two readings
Dobrindt called the attacks climate extremism and then climate terrorism by a lone perpetrator, and Reul described a misguided individual acting alone. Saxony's interior minister, Armin Schuster, did not. He called the case extraordinary in the way it was carried out and in the way it was claimed, said it could be left-wing extremism or could be about the climate, and added: “Es sei aber auch moeglich, dass der Taeter im Auftrag gehandelt habe” - it is also possible the perpetrator acted on someone's orders. Asked whose, he said he did not want to speculate.
7. What has not changed
Nobody has been convicted. No German authority has named a state, and no state has been excluded. The wider European wave against defence and logistics targets - Leipzig/Halle, the Polish drone-plant fires, Munich - is separately investigated and unaffected by this arrest. And the grid effect recorded in this report stands: about 3,000 megawatts came off at Bergheim and one block tripped in Brandenburg.
This report was right to refuse the attribution, and that is the finding
On 2 September this file carried no actor, named no state and set out two candidate sets because that was what the evidence supported. Within a week the leading line had moved to a domestic single-issue actor with a name, a home address and a truck. A saturated grey-zone environment makes every attack on infrastructure look like the campaign everyone is already watching, and it took one handwritten letter to break that reading. It is now likely that this series is domestic single-issue sabotage rather than state-directed action, on the strength of the claim letters, the perpetrator knowledge in them, the arrest in possession, and the match to the January 2026 Berlin grid arson in both method and language.
Likely is not settled, and one minister has said so out loud
Two interior ministers called it a lone actor and a third said it is also possible he acted on orders. That is not a politician hedging; it is the responsible position while the direction of the tasking is unexamined. It remains a realistic possibility that the perpetrator was encouraged, tasked or supported by someone else, including a hostile service, because a single-issue actor with a real motive is exactly the profile a hostile service looks for, and a genuine claim letter is not evidence of who suggested the target.
Twenty-three rockets, one detonation, and the grid still stood
If the ZDF figure holds, the Brandenburg attack was an attempt with about a four per cent success rate, and the whole campaign produced no blackout. That is not a compliment to German grid protection: the sites were reached freely, repeatedly, over a week, by one man working from a truck. The redundancy of the network absorbed the effect and the security of the sites did not prevent the attempt. Design margin did the work that a fence was supposed to do, and design margin is finite.
Members of the public found the device, again
The Dormagen device was found by a passer-by. This is the fifth time in recent Scorpius reporting - with Tulcea, Neptun Deep, the Romanian field and Munich - that the effective detection capability against an attack on infrastructure was an ordinary person who happened to be looking. Four of those five sites had protective systems. None of those systems is what raised the alarm.
Where this goes
It is highly likely that further charges follow and that the Saxony and Lower Saxony incidents reported as linked are formally attached to this case or excluded from it. It is a realistic possibility that the investigation examines whether the suspect was in contact with anyone who encouraged or directed him, which is the question Schuster left open. It is almost certain that German energy infrastructure continues to draw both domestic-extremist and hostile-state interest, because this case removes one actor and changes nothing about the accessibility of the target set.
This update was written on 11 September 2026 from reporting published between 3 and 9 September. The original report of 2 September 2026 and the update of 2 September are unchanged above.
- https://www.zdfheute.de/politik/deutschland/brandenburg-sprengvorrichtung-umspannwerk-jaenschwalde-100.html
- https://taz.de/Sabotage-am-Umspannwerk/!6209191/
- https://www.tagesspiegel.de/potsdam/brandenburg/anschlag-auf-umspannwerk-in-brandenburg--zweistellige-zahl-an-sprengvorrichtungen-gefunden-16004358.html
- https://www.euronews.com/my-europe/2026/09/01/rockets-fired-at-substation-in-brandenburg-in-suspected-deliberate-attack
- https://www.rwe.com/en/press/rwe-power/2026-09-02-rwe-power-plants-in-the-rhenish-region-affected-by-an-incident-near-a-substation/
- https://brusselssignal.eu/2026/09/police-treat-cologne-substation-failure-as-deliberate-attack/
The first four sources above were used for the original report of 2 September 2026. The final two - RWE's own statement and Brussels Signal - were used for the update later the same day.
Compiled from open-source reporting for professional security discussion. This is a protective-security lessons-learned assessment, not an operational account. Nobody has been arrested and no organisation has claimed responsibility. No attribution has been made and no line of enquiry has been named as primary; both domestic left-wing extremism and foreign involvement have been referred to publicly and neither is established. The nature of the devices is described differently by the grid operator, by Brandenburg's interior minister and by the police, and those three accounts are set out here rather than reconciled. No map accompanies this report: the substation is not present in the mapping data Scorpius uses and no coordinate has been published to it, so nothing is plotted rather than plotted approximately. Figures for devices recovered and for the plant's response are as reported and may be revised.
Turnow-Preilack was not the only German substation attacked that day. At about 20:00 the same evening, roughly 500 km west, an Amprion substation in the Rhenish lignite field was hit, and five RWE generating units disconnected from the grid. The eastern attack took one 500-megawatt block offline. The western one took about 3,000 megawatts. Police in North Rhine-Westphalia are treating it as a deliberate act and say it is too early to say whether the two are connected.
1. A second substation, the same night, at the other end of the country
An Amprion installation in the Rheidt district of Bergheim, Rhein-Erft-Kreis, west of Cologne, was struck at about 20:00 on 1 September, producing a short circuit on high-voltage lines. Turnow-Preilack sits on the Polish border; Bergheim sits near the Belgian and Dutch one. Both are transmission substations feeding lignite generation.
2. Five generating units came off the grid
RWE states that Neurath G and F and Niederaussem H, G and K, 4,200 megawatts of installed capacity, disconnected, and that they were supplying about 3,000 megawatts at the time. Reconnection was staged: Neurath G and Niederaussem H, some 1,600 megawatts, that morning; Neurath F, about 1,000 megawatts, later the same day; Niederaussem G and K, another 1,600 megawatts, by the weekend. General supply was not interrupted.
3. The police there have gone further than Brandenburg did
Essen police lead the western inquiry. A spokesman said: "we are not proceeding on the basis of a technical defect, but of a deliberate act, a criminal offence." That is a firmer public position than anything said about Turnow-Preilack, where the LKA has named no line of enquiry as primary.
4. Drones are reported and not confirmed
Residents reported flashes of light and explosive noises, and video is described as showing two flashes at ground level followed seconds later by detonations. Police declined to confirm reports that drones were used. This is the same problem as the Brandenburg device description: the method is being reported ahead of the investigation, and the reported method is the more alarming version.
5. Officially, the two are not linked
North Rhine-Westphalia police said it was too early to establish whether the two events were connected. No group has claimed the Bergheim short circuit, and there are no arrests at either site.
6. What has not changed
Nothing about Turnow-Preilack itself. No attribution, no claim, no arrests, and the three conflicting official descriptions of the devices still stand unreconciled. General supply was not interrupted at either site, and nobody was hurt at either.
Two sites in one day changes the scale of the question, not the attribution
Two deliberate attacks on transmission substations in one country inside about twelve hours, both producing short circuits on high-voltage lines, both against nodes feeding lignite generation, at opposite ends of Germany. It is likely that the two are connected, on the method, the target class and the interval. Police say it is too early to establish that, and this band is Scorpius's judgement rather than theirs. Connection is not attribution, and neither event has an actor.
The western attack worked, on any measure that matters operationally
Turnow-Preilack took one 500-megawatt block off automatic protection. Bergheim took about 3,000 megawatts of live generation off the grid and needed a staged reconnection running to the weekend. The original report noted that the eastern attack failed against network resilience rather than site security. The same resilience absorbed six times the loss the same night, which is the finding, and it says nothing about whether either site was defended.
The reported method is running ahead of the investigation at both sites
In Brandenburg it was the word rocket; in North Rhine-Westphalia it is drones, reported locally and not confirmed by police. In both cases the most striking version of the method reached the public first. An organisation briefing from the coverage rather than from the police statements will have described two drone-and-rocket attacks on the German grid, and neither force has said that.
Where this now sits
It remains highly likely that attacks on European grid nodes continue. The second site raises rather than lowers the earlier judgement on consequence: it is now a realistic possibility that a subsequent attempt causes an area outage, and the demonstration that two points on one national grid can be reached in a single evening is available to any actor as an argument, whoever made it. Attribution for either site is unlikely to be resolved quickly.
The original report of 2 September 2026 appears above this section and has not been altered. Sources used for this update are the final two in the source list above.