From 31 October to 2 November 2026 the pro-Russian group NoName057(16) and a second hacktivist chat posted under the tag #OpGermany. They claim that public transport websites in central Germany went down and that they reached the control system of a small gas-engine power plant. Both claims rest on the groups’ own posts and check-report links.
This explainer sets each claim next to what has been confirmed, using counts from Brandefense Blackhole. We name no plant, operator or channel and link no posts or check reports published by the groups.
What Does the #OpGermany Campaign Claim?
On 2 November the group’s posts in several languages say that public transport in central Germany has been shut down. They list the regional transport association of central Saxony and the transport sites of Magdeburg, Halle and Dessau, and say the Saale district is also hit.
A second post says all six portals of the Rhine-Main transport association and several Wiesbaden city services are down, and labels them as closed by geographic location. As proof they post reports from a public website-availability checker.
A second set of posts the same day claims access to the control system of a gas-engine power plant in Germany. It is the same day as the transport claims and is posted in the same channels.
The posts describe a 250 kW unit built on a MAN E2848 engine with a Woodward easYgen controller, and list temperatures, boost pressure, NOx, run hours and logs. They say the log shows recent overheating alarms and a power reduction and that “everything is visible”. The posts end with the group’s statement that control “has now been switched to manual mode” and that it is monitoring the plant.
The group links the campaign to youth protests. A post cites Bild as reporting protests under the name “Gen Z regelt” in more than 30 German cities since 31 October. We have not opened that report, so the protest figures are the group’s retelling of it.
- Period.
- 31 October to 2 November 2026.
- Claimed actors.
- NoName057(16) channels in several languages; a second group’s chat posts its own lists under the same tag.
- Claim A.
- DDoS outages of transport websites in central Germany (Saxony, Magdeburg, Halle, Dessau, Saale district) and of the six portals of the Rhine-Main transport association plus Wiesbaden city services.
- Claim B.
- Access to the control system of a 250 kW gas-engine plant (MAN E2848 engine, Woodward easYgen controller), with control said to be switched to manual mode.
- Stated motive.
- Support for German youth protests reported by Bild.
- Independent confirmation.
- None found as of 3 November 2026.
Claim Ledger: What Brandefense Blackhole Shows
Brandefense Blackhole holds 45 Telegram posts that carry the tag #OpGermany, dated 31 October to 2 November 2026: 8, 14 and 23 per day. They come from 8 channels, most of them language versions of the NoName057(16) channels. Our wider search for NoName057 returns 338 posts since 27 October, which shows how loudly the group publishes.
Of the 45 posts, 25 contain a link to an availability-check report, 13 mention public transport and 13 mention the protests. Six posts mention the E2848 engine, all on 2 November. They are the same announcement in Russian, Italian, Spanish, French and English, plus a repost, so they are one claim and not six plants.
| Point | What the posts say | What we can confirm |
|---|---|---|
| Transport sites down | Central German transport sites and six Rhine-Main association portals plus Wiesbaden services down, shown by checker reports | The posts exist in Blackhole. The reports show a moment of unreachability, not how long it lasted or what it hit. The Rhine-Main post itself says several portals were “closed by geo”, which points to location blocking, our reading |
| Rides disrupted | Public transport in central Germany “has been shut down” | Unconfirmed. A website outage does not stop vehicles, and the posts show only website checks |
| Plant access | Control system of a 250 kW gas-engine plant reached | Unconfirmed. We saw only the group’s text; the plant, operator and place are not independently identified |
| Control action | Logs and values “visible”, control switched to manual mode | The group says it took the plant’s control to manual mode; we have no evidence of it. Reading values alone would not be control |
| Protest link | Campaign backs Gen Z protests | A motive stated by the group, not a finding |
Outside confirmation or denial of either claim, in the sources we checked on 3 November 2026: none found. We wrote this ledger from the groups’ posts and our own counts only.
Why a DDoS Claim Is Not Proof of Impact
A distributed denial-of-service attack floods a service with requests so that users cannot reach it. It harms availability only, and no data is read or changed. See our entry on DDoS attacks for the basics.
The checker reports the group posts show that a site did not answer test requests at one moment. They do not show how long the outage lasted, whether timetables and ticket sales broke, or whether only a public web page was affected. The group chooses which reports to publish, so failed attempts do not appear.
Our incident page on the NoName057(16) DDoS campaigns against Italy shows the same method. ENISA’s findings are summarised in our hacktivism DDoS trends article.
What Does a Claimed Plant Access Prove?
A human-machine interface (HMI) is the screen operators use to watch and tune a machine. Small plants can expose it to the internet for remote service, sometimes with a weak password or none. Our reading is that the posts fit this pattern, because they describe values and logs and not a deep network intrusion.
- Plant operationEngine runs and power is delivered; the group says control was switched to manual mode; unconfirmedWho can check itOperator
- Controller logicSetpoints and protections; the group says control was switched to manual mode; unconfirmedWho can check itOperator and integrator
- Remote panel (HMI)Values, graphs and logs on screen; this is what the posts describeWho can check itOperator
- Internet pathOur reading: a reachable address with weak or no login is the likely entryWho can check itOperator and provider
Whether the panel was reachable by design or by mistake is something only the operator can tell. The posts describe access to a view, and the group’s own text says the log lists overheating alarms, which a normal plant also records. The step from viewing to controlling is the one that would matter for safety. The group does claim that step (“manual mode”), but offers no evidence we can check, and the operator has not confirmed it.
The same Blackhole search shows the group also claims access to a German wood-drying installation. This repeats the pattern: small industrial equipment and an exposed panel. The group’s text calls it “completely exposed” and says everything is “under our control”; we cannot verify that.
What Can Transport and Small Plant Operators Do Now?
The steps below are our advice, not findings from the sources above. They apply whether or not these particular claims prove true, because the method is cheap and repeatable. For the wider exposure problem, read our entry on attack surface.
- Find exposed panelsSearch your own address ranges for HMI, SCADA and remote-service pages open to the internet, and close or put them behind a VPN with multi-factor sign-in.
- Change defaultsReplace factory and shared passwords on controllers and remote gateways, and remove accounts nobody uses.
- Separate public and operational systemsKeep the public website, ticketing and operations on different networks so that a web outage cannot reach vehicles or machines.
- Prepare for DDoSAgree with your hosting or network provider on traffic filtering, a static fallback page and a contact who answers at weekends.
- Keep a manual planKnow how timetables, dispatch and plant operation continue if the website or remote access is down.
- Check claims before you answerWhen a group names you, confirm from your own logs and monitoring first, then say what you know
What Is Still Unknown?
We do not know how long any site was unreachable, which pages were hit, or whether an operator saw an effect. We also do not know whether the plant access is real, how it was gained or whether the plant has since been secured. The next useful facts would come from the transport association, the plant operator or German authorities. We will update this article if a named party confirms or denies either claim.