On the evening of September 1, 2026, a deliberate short circuit near the Rommerskirchen extra-high-voltage substation west of Cologne knocked several lines out of service. Hours earlier, explosive devices had been found on a 380-kilovolt node near the Jänschwalde power plant in Brandenburg. Neither event caused a general outage. The grid operator said the general electricity supply was at no point affected. Yet, according to the Associated Press, RWE reported that five coal-fired units with a combined capacity of 4,200 megawatts went offline, with three expected back the next day and the remaining two by the weekend.
For anyone who owns, finances or insures a facility that depends on the grid, that gap between "no outage" and "four gigawatts offline" is the point. The physical damage was modest and sat on someone else's property. The economic consequence sat on the generators.
What happened, and what is still unsettled
German officials treated both incidents as crimes from the outset. North Rhine-Westphalia's interior minister said investigators were weighing "sabotage directed by a foreign government and left-wing extremism," and Brandenburg's interior minister described a possible "hybrid threat." A week later, on September 8, Cologne police arrested a 48-year-old suspect near the Weisweiler power plant who was carrying further explosive devices. Agence France-Presse reported that the attackers had used firework-like rockets to drop wires across high-voltage lines, that the suspect had claimed the attacks in handwritten letters, and that the federal interior minister said authorities "must assume that this is a case of climate extremism."
The investigation continues and the legal characterization is for German courts. What matters for an investor is the sequence: within one week, the leading public explanation moved from possible state-directed sabotage to suspected domestic extremism. Coverage decisions, lender notifications and tenant communications can all depend on which of those explanations is accepted, and when.
Why "no outage" is not "no loss"
Three features of the September attacks are worth carrying into any facility review, in Germany or elsewhere.
- The damaged asset and the loss-bearing asset were different. The lines and substation belong to transmission operators. The lost output belonged to the plant owner. That separation is where many insurance programs are thinnest.
- The interruption outlasted the repair. Units were expected back over several days, not hours. Restart sequences, inspections and grid coordination add time that a simple "lines restored" headline does not show.
- The method was cheap and the target was exposed. Overhead conductors cannot be enclosed, and a node that serves several large consumers concentrates risk on a single location.
The insurance question: whose property, which clause
Many commercial property forms connect business interruption to direct physical loss or damage at the insured location. When the damage is at a utility's substation instead, recovery usually depends on extensions such as utility service interruption or contingent business interruption. Those extensions are frequently sublimited, subject to a waiting period, and narrowly defined. Some treat overhead transmission and distribution lines as an optional coverage that must be selected and priced, which is exactly the equipment involved near Cologne.
The second question is cause. A malicious-damage clause, a terrorism exclusion or endorsement, and a war or hostile-act exclusion may each be read against the same event. When officials publicly debate whether an attack was directed by a foreign government or by a domestic activist, the owner should expect the insurer to examine that question closely as well. In the United States, for example, federal terrorism backstop coverage applies to acts the Treasury Secretary formally certifies, and a policyholder who declines terrorism coverage may have terrorism losses excluded, as the Congressional Research Service explains.
None of this means a claim would fail. It means the answer is in the policy wording and the dependency map, and both should be read before an event.
What owners, lenders and insurers should ask
| Diligence question | Why it matters |
|---|---|
| Which off-site substations, lines and feeds does the facility depend on, and how many are single points of failure? | Concentration on one node turns a third party's incident into the owner's income loss. |
| Does the program include utility service or contingent business interruption, and does it extend to overhead lines? | Off-premises damage is often covered only by extensions with their own limits and exclusions. |
| What is the waiting period compared with a realistic restart time? | A multi-day restart can fall largely inside a deductible or waiting period. |
| How do the malicious-damage, terrorism and war clauses interact? | The same event can be characterized differently as an investigation develops. |
| What on-site controls protect the owner's own critical equipment? | The owner cannot harden the utility's line, but can document protection of the switchyard, transformers, generators and control rooms it does own. |
What this means for asset value
Lenders and buyers already price grid dependency through interconnection studies and capacity contracts. The September attacks suggest that physical exposure of that dependency deserves the same attention. A facility served by a single, exposed transmission node carries a concentration risk that does not appear on its own balance sheet but can appear in its income statement. A facility with documented redundancy, a mapped dependency chain and insurance wording that matches it is easier to underwrite, finance and sell.
Tenant quality follows the same logic. Occupiers with continuous operations, such as data centers, cold storage and process manufacturing, have good reason to ask how a site behaves when the grid does not fail outright but a key node is lost. An owner who can answer that question with evidence holds a stronger position at lease renewal.
Where physical protection fits
Hardening transmission lines is the grid operator's responsibility, and the regulatory frameworks for it sit with operators and regulators. The owner's role is narrower and more practical: protect the equipment it controls, keep the record current, and make sure the people who price the asset can see both. A substation perimeter review for owner-controlled switchyards, together with an honest assessment of on-site resilient power, gives underwriters and lenders a clearer view of what the owner has done and what remains outside its control.
The German attacks did not black out a region. That is precisely why they are useful: they show how much financial exposure can sit behind an incident that, on the morning news, looked like a near miss.
Frequently asked questions
Does a property policy cover lost income when a utility's equipment is sabotaged?
It depends on the wording. Many forms tie business interruption to physical loss at the insured location, so off-site utility failures fall to separate extensions such as utility service or contingent business interruption. Those extensions often carry sublimits, waiting periods and exclusions that the owner should read before an event, not after.
Why does the cause of an attack matter to an insurance claim?
Different causes can fall under different clauses. A malicious act, a terrorist act and an act attributed to a foreign state may be treated differently by the same policy, and the characterization can take days or weeks to settle.
Is protecting the substation the owner's responsibility?
Usually not. Transmission equipment belongs to the grid operator. The owner's job is to understand the dependency, decide how much of it to retain, and document that decision for lenders and underwriters.
Need to frame a facility decision?
ISCoA helps owners organize physical security exposure, mitigation priorities and evidence requirements before product selection.
Request a preliminary review