A nationwide GSM-R outage stopped trains across Germany, exposing how one aging communications system can still bring an entire rail network to a halt
At 10:30 PM on Tuesday June 23, Deutsche Bahn told passengers something that had never happened before for technical reasons: all trains across Germany were being held at their stations.
The company confirmed the outage was caused by a nationwide failure of its GSM-R system, the Global System for Mobile Communication for Railways, which handles internal communication across the entire rail network. Without that link, running trains safely isn’t possible, so nothing moved.
“All trains are suspended in Germany’s most populous state, North Rhine-Westphalia.” reported the German media outlet DW.
That line alone gives you the scale. Berlin’s public transport authorities confirmed that municipal, regional, and long-distance Deutsche Bahn trains were all affected. The Berlin S-Bahn suspended all trains on all lines. Stuttgart halted everything on its network.
Deutsche Bahn CEO Evelyn Palla spoke to Bild newspaper in the early hours and was candid about where things stood:
“We are now trying to get the trains into stations so that travelers can disembark. And then we have to fix the problem, which we don’t yet know.” Deutsche Bahn CEO Evelyn Palla said.
That quote is doing a lot of work. The head of one of Europe’s largest rail operators, publicly admitting she didn’t yet know what had broken her entire network.
Engineers identified the cause of the disruption within roughly ninety minutes of the first announcement, and the network came back online just before 1 a.m. Deutsche Bahn said technicians were working around the clock and later confirmed the fix was successful. The company apologized to passengers and said it would issue taxi and hotel vouchers to those affected, with replacement buses arranged where possible.
The Stuttgart S-Bahn’s statement to passengers during the outage captures exactly the kind of uncertainty that cascaded across every station in the country.
“At present, all S-Bahn trains across the entire network are being held at platforms.” said authorities in Stuttgart. “Please check your journey in the travel information system for alternative transport options. We will inform you as soon as we have new information and can assess how long the disruption will last.”
Which is the polite way of saying: we have no idea how long this will last.
GSM-R is a railway-specific version of 2G mobile technology, deployed across Europe since 2000 as the standard for voice and data communications between drivers and control centers. Deutsche Bahn has already signed with Nokia to replace it with a 5G system using the Future Railway Mobile Communication System standard. That replacement hasn’t arrived yet, which means the network that failed Tuesday night is still the one everything depends on. No evidence of a cyberattack or physical infrastructure damage has emerged. The exact technical cause of the failure has not been publicly disclosed. Deutsche Bahn is already notorious for frequent delays and cancellations. A complete nationwide technical halt, in calm weather, with no external cause, is a different category of problem from a late train.
At this time, the situation appears normal; however, as of 6:30 AM, DB warned “some isolated disruptions may still occur” and advised passengers they’ll need to check that their connections will run on time.
The Register confirmed that there is no evidence that the outage was caused by a cyberattack or by physical infrastructure damage such as cut cables. The incident nevertheless raises questions about resilience, as critical infrastructure networks are expected to include multiple layers of redundancy to prevent widespread disruptions. The organization praised its IT team, stating that its experts worked tirelessly and successfully restored services.
In August 2023, Poland’s Internal Security Agency (ABW) and national police launched an investigation into a hacking attack on the state’s railway network. According to the Polish Press Agency, the attack disrupted the traffic overnight.
Stanisław Zaryn, deputy coordinator of special services, told the news agency that Polish authorities were investigating the unauthorized usage of the system used to control rail traffic.
Since the beginning of the Russian invasion of Ukraine, Poland’s railway system has represented a crucial transit infrastructure for Western countries’ support of Ukraine.
Zaryn explained that the attacks are part of a broader activity conducted by Russia to destabilize Poland.
In April 2024, the Czech transport minister Martin Kupka warned that Russia conducted ‘thousands’ of attempts to sabotage European railways.
The Czech Republic’s transport minister told the Financial Times that the attacks aim to destabilize the EU and sabotage critical infrastructure.
Kupka confirmed that Russia-linked threat actors have conducted “thousands of attempts to weaken our systems” since the beginning of the Russian invasion of Ukraine.
The state-sponsored hackers also targeted signaling systems and networks of the Czech national railway operator České dráhy, Kupka said.
The Czech cyber defense was able to detect and neutralize these attacks; however, the minister highlighted that sabotaging railways could cause serious accidents.
At the end of October 2022, a cyberattack caused trains in Denmark to stop; it hit a third-party IT service provider. The attack hit the Danish company Supeo, which provides enterprise asset management solutions to railway companies, transportation infrastructure operators, and public passenger authorities.
DSB is the largest train operating company in Denmark.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, newsletter)
Entrar
