Sabotage halts Dutch trains or a Rotterdam terminal for a day
The test Between 26 Oct 2026 and 25 Oct 2027, a deliberate physical or cyber act halts most train services in the Netherlands, or all operations at a Rotterdam port terminal, for 24 hours or more.
Not under way · Confidence: low · Reviewed 25 Oct 2026 · Scores from 1 to 10
This page answers: What could happen, how it is scored, and who is exposed?
Using this page
- Read the two scores: Likelihood and Impact are kept apart.
- Check what is happening, each fact with its source.
- Use the calendar for the dates to watch.
Follow this riskSign in to follow; one weekly email if you ask for it.
Likelihood ↑ 15 Sep 2026: pipes fastened to tracks at 27 sites stopped trains across the centre, north and east of the Netherlands from the morning rush hour; ProRail said it appeared deliberate (VRT, Reuters).
Impact is the average of the four parts, rounded, plus one point when Canada is directly hit on two or more channels, up to 10.
Two separate scales from 1 to 10. Strature never multiplies or merges them.
What changed
Dated, newest first
- ProRail: about 7,000 km of track, 160 million train-km a year [9]
- Port throughput 323.2 Mt in Jan-Sep 2026, up 0.9%; oil product exports up 31.9% [8]
- No arrests and no claim; police and AIVD name no suspect; cleared tracks hit again that evening [1]
- First report 5:30 on 15 Sep; signal faults at more than 20 places; pipes at 27 sites; services gradually restored by midday; Infrabel saw little or no effect in Belgium [2]
- ProRail: at this stage it appears to be a deliberate disruption caused by human action; around 20 incidents; level crossings closed [3]
Why it matters
On budget day, 15 Sep 2026, metal pipes fastened to tracks at 27 sites made signals show occupied lines, and trains across the centre, north and east of the Netherlands stopped from the morning rush hour. Services came back gradually by midday. Reports on 16 Sep pointed to radical farm protesters; police named no suspect and no group claimed it. No charges have been reported. Dutch services said in 2025 that the Russian sabotage threat was rising. No sabotage that stopped the national rail network or a Rotterdam terminal for a full day has been reported.
Why Likelihood 3 Pushes: a coordinated attack at 27 sites repeated that evening, no one charged, a state threat the services called rising in 2025. Brakes: the 24-hour bar is high and service returned by midday, faults show at once, many routes.
Why Impact 4 Threshold case one day without most trains.
The other facts on file (3)
- AIVD, MIVD and NCTV: sabotage threat from Russia and pro-Russian individuals has risen [5] (17 Jul 2025)
- MIVD 2024: first known cyber-sabotage attack in the Netherlands, no damage; Russian operation against vital infrastructure did not gain access [6] (23 Apr 2025)
- Blast at Gunvor's Rotterdam refinery and fuel terminal kills at least one; police: workplace accident for the time being; a separate port power failure ruled unrelated [7] (13 Aug 2026)
Where it sits
How it spreads
Between 26 Oct 2026 and 25 Oct 2027, a deliberate physical or cyber act halts most train services in the Netherlands, or all operations at a Rotterdam port terminal, for 24 hours or more.
Not under wayChannels 5 on the card
- CanadaNo direct Canadian loss sourced.
- Passengers and workersA day without trains strands much of the daily commute.
- Freight and the hinterlandRail links Rotterdam to Germany and Belgium; a halt delays containers and bulk (not sized).
- Energy and productsA Rotterdam oil terminal halted for a day would slow product exports.
- Security policyA state-linked attack would raise spending on rail and port protection (Strature's view).
Sectors 3
- Rail
- Ports and logistics
- Energy and pipelines
Countries 3
- Netherlands primary
- Germany
- Belgium
Who is exposed
- Countries
- Netherlands, Germany, Belgium
- Sectors
- Rail, Ports and logistics, Energy and pipelines
Three scenarios and their signposts
- S1
Hours, not days
Track sabotage recurs, but service returns within the day.
- S2
A day lost
Repeated attacks at many sites, or a cyber attack on signalling, stop the network for a day.
- S3
A terminal down
A cyber or physical attack stops a Rotterdam terminal for a day or more.
| Path | Signpost |
|---|---|
| S1 | Arrests or charges for 15 Sep |
| S2 | A second multi-site attack within a month |
| S3 | A port incident that police treat as deliberate |
No probability is given for the three paths.
Dates to watch
The dates to watch
A dot is a day, a bar a month or a year; a hollow mark is tentative. The line marks today.
- Apr 2027 AIVD annual report for 2026 (due before 1 May under the Wiv 2017) [11] Tentative · Outside event
The other side
Rail and port security, monitoring of track circuits and cyber defence for terminals can come out stronger after a near miss; Infrabel's monitoring of trains from its signal boxes is one model.
Connected in Strature
- Netherlands
- Germany
- Belgium
- State sabotage kills someone or shuts a German airport or rail line for a day Shares a channel: Sabotage that stops a main rail line or airport for a day.
- Two or more undersea cables or pipes cut in one Baltic or North Sea incident Shares a channel: State sabotage of infrastructure.
- A state-linked cyber attack cuts power, water or a port for a day or more Shares a channel: Cyber attacks on control systems.
Sources
9 sources, numbered as the text cites them
- Rail sabotage: farm activists suspected as police investigate. DutchNews.nl · 16 Sep 2026 · News · confidence medium · retrieved 25 Oct 2026
- Sabotage suspected as Dutch railways suffer major disruption. VRT NWS · 15 Sep 2026 · News · confidence medium · retrieved 25 Oct 2026
- Suspected sabotage disrupts Dutch trains, level crossings. The Star (Reuters) · 15 Sep 2026 · News · confidence medium · retrieved 25 Oct 2026
- Inlichtingendiensten: sabotagedreiging gestegen, aanval Rusland onwaarschijnlijk. NOS · 17 Jul 2025 · News · confidence medium · retrieved 25 Oct 2026
- MIVD ziet Russische dreiging tegen Nederland toenemen. Security Management · 23 Apr 2025 · News · confidence medium · retrieved 25 Oct 2026
- Rotterdam port explosion: one dead, several injured. CP24 (AP) · 13 Aug 2026 · News · confidence medium · retrieved 25 Oct 2026
- Throughput in the port of Rotterdam rose by 0.9% in the first nine months of the year. Port of Rotterdam Authority · 16 Oct 2026 · Official · confidence high · retrieved 25 Oct 2026
- Over ons. ProRail · 25 Oct 2026 · Official · confidence medium · retrieved 25 Oct 2026
- Brief regering: aanbieding openbaar jaarverslag AIVD 2025 (Kamerstuk 30977, nr. 177). Officiële Bekendmakingen · 23 Apr 2026 · Official · confidence high · retrieved 27 Oct 2026
Reviewed 25 Oct 2026 · version 1 · last change: reviewed · All risks