This is how they got in: ten real cases of physical hacks and sabotage

In recent weeks we wrote about the PHP flaw of 21 October and about the security of the smart building. This time we look at the side that people often forget: the physical side. A firewall does not help if someone simply walks in. We list ten real cases: what happened, what the damage was and how it could have been prevented.

If you walk in, you are on the network

Case 1: the fake engineer at Barclays (London, 2013)

What happened? In April 2013, a man arrived at a branch of the British bank Barclays in London. He said he had come to repair the computers. He connected a small device to a computer in the back office: a KVM switch with a mobile internet connection. With it, the gang could control the computer remotely, from a hotel nearby.

The damage: more than 1.25 million pounds disappeared in 128 transfers. About 600,000 pounds was recovered later. A few months later, the gang tried the same thing at a branch of Santander. There it went wrong for the criminals: the police stepped in before any money was gone. In 2014, five gang members were convicted.

How could it have been prevented? Do not let an engineer in without an appointment, and if in doubt, call the supplier yourself. Do not leave visitors alone in rooms with IT. And make sure the network does not simply accept an unknown device.

Case 2: inside help at Sumitomo Mitsui (London, 2004)

What happened? At the London office of the Japanese bank Sumitomo Mitsui, the bank's own security guard let a group of criminals in after office hours. They installed keyloggers on computers: small devices or programs that record everything someone types, including passwords.

The damage: with the stolen login details, the criminals tried to transfer about 229 million pounds to accounts abroad. This failed because of mistakes when they entered the details. No money was lost, but it was a close call. Convictions followed in 2009.

How could it have been prevented? Do not give anyone access on their own outside office hours, record who is inside and when, and actually check that record. Check computers regularly for strange devices between the keyboard and the computer.

Case 3: break-ins for drug smuggling in the port of Antwerp (2011 to 2013)

What happened? Drug traffickers wanted to change the data of containers in the port of Antwerp, so that their containers could be collected unseen. When an attack by email did not work, they broke into the offices of port companies. They installed keyloggers on the computers.

The damage: for about two years, containers with drugs left the port without anyone noticing. The Belgian and Dutch police worked together and in 2013 fifteen people were arrested.

How could it have been prevented? Lock offices properly and protect them with an alarm, check computers for strange devices, and separate the business systems from the normal office network.

A small device, a big door

Case 4: a USB stick in the port (Antwerp and Rotterdam, 2020)

What happened? A Dutch man persuaded an employee of a container terminal in Antwerp to put a USB stick into a work computer. The stick contained malicious software. This gave the group access to the systems for containers, access gates and staff passes. They also stole the camera locations and floor plans of the terminal.

The damage: the access helped to smuggle 210 kilos of cocaine, which was intercepted in Rotterdam in September 2020. In January 2026, the Amsterdam Court of Appeal sentenced the man on appeal to seven years in prison.

How could it have been prevented? Block USB sticks on work computers. Separate the systems for access and cameras from the office network. And record which devices belong on the network, so that a new device stands out.

Case 5: a Raspberry Pi at NASA (United States, 2018)

What happened? A Raspberry Pi was connected to the network of NASA's Jet Propulsion Laboratory. This is a small computer that costs a few tens of euros. It was connected without permission and was not on the list of devices. An attacker used the device as a way in. Because the network was not properly divided, he could then move on to other parts.

The damage: according to the investigation report of the NASA Inspector General, about 500 megabytes of data disappeared, including data about a Mars mission. As a precaution, some systems were disconnected for a while.

How could it have been prevented? Keep a complete list of all devices on the network, refuse unknown devices and divide the network into separate parts. A small computer behind a cabinet or under a desk only stands out if someone deliberately looks for it.

Break-ins and sabotage of the infrastructure

Case 6: break-in at a Vodafone network site (Basingstoke, 2011)

What happened? In the night of 28 February 2011, burglars forced open the door of an unmanned Vodafone network site in Basingstoke, England. They took network switches and other equipment.

The damage: in parts of southern England, calls, text messages and mobile internet failed for a large number of customers. According to Vodafone, no customer data was stolen.

How could it have been prevented? A strong door, an alarm with a fast response, cameras and a network that does not depend on one location.

Case 7: two cut cables at Deutsche Bahn (Germany, 2022)

What happened? On 8 October 2022, fibre optic cables were cut in two places. They belonged to the radio system that train drivers and traffic control use to stay in contact. The two cables were meant to be each other's backup.

The damage: train traffic in northern Germany stopped for about three hours. The criminals have not been found.

How could it have been prevented? A real backup means two connections that share no weak spot, along different routes. Cable ducts and manholes should be closed and secured.

Case 8: fibre optic cables cut during the Olympic Games (France, 2024)

What happened? In the night of 28 to 29 July 2024, during the Olympic Games, cables of several French telecom providers were cut, in about nine departments. A few days earlier, the French railway had already been the target of arson.

The damage: internet, fixed telephone lines and the mobile network failed in some places. At the provider SFR alone, about 10,000 fixed connections were affected.

How could it have been prevented? It is hard to fully prevent this with cables in public spaces. But a building with two connections from different providers, through two separate entry points, stays reachable when one cable is cut.

Case 9: transmission masts set on fire (the Netherlands, 2020)

What happened? Between 3 April and 26 May 2020, 29 transmission masts in the Netherlands were set on fire, according to the Dutch Public Prosecution Service. The cause was conspiracy theories about 5G.

The damage: mobile coverage failed in some places, also for the emergency services. Suspects were arrested.

What does this mean for buildings? Antennas and technical rooms on the roof should be behind a lock and an alarm. And if you depend on mobile internet, you need a fixed connection as a backup.

Case 10: fire on a cable bridge leaves Berlin without power (Germany, 2026)

What happened? On 3 January 2026, criminals set fire to a cable bridge over a canal in Berlin. Five high voltage cables were destroyed. A left-wing extremist group claimed the attack.

The damage: about 45,000 households and more than 2,200 businesses were without power, many of them also without heating and internet. It took about five days before everyone had power again.

What does this mean for buildings? Know what still works if the power is out for a long time. Emergency power for the most important IT, a plan for outages and agreements with suppliers make the difference between a few hours and a few days of downtime.

How often does this happen?

Physical attacks are not rare. In 2024, the German digital industry association Bitkom asked 1,003 companies about their experiences. 62 percent had dealt with theft of IT or telephone equipment, or suspected it. 26 percent had dealt with physical sabotage of systems or processes, 9 percentage points more than the year before. But only 54 percent had taken measures to protect their IT against physical attacks.

What the cases have in common

• The door was the weak spot, not the software. In none of these cases would a better firewall have helped.
• Trust was abused. A fake engineer, the company's own security guard, an employee who was persuaded. People quickly tend to let someone with a good story in.
• Small devices, big consequences. A KVM switch, a keylogger, a USB stick or a Raspberry Pi: all small, cheap and easy to hide.
• One network for everything. If you got in at one place, you could often go further.
• A backup that was not a backup. Two cables on the same route, or one location where everything comes together.
• Nobody was looking. What is not on the list and is not checked does not stand out.

How to prevent it: ten measures

1. Keep the server room and patch cabinets locked, and know who has a key or a pass.
2. Record who has been inside and when, and check that record.
3. Do not let an engineer in without an appointment, and if in doubt, check with the supplier.
4. Do not leave visitors alone in rooms with IT.
5. Make sure the network refuses unknown devices.
6. Keep a list of all devices on the network.
7. Block USB sticks on computers where possible.
8. Separate the office network from guests, other tenants and the building systems.
9. Have a second connection, along a different route and through a separate entry point.
10. Know what still works if the power fails, and have emergency power for the most important IT.

You can read more about the physical security of IT rooms in The door to your server room.

Where the IT-Label and our services help

• IT-Label Security Audit. A specialist checks on site your Wi-Fi, network equipment, server room and patch cabinet, the place where the internet connection comes in, unknown devices on the network and the separation between networks. You get a report with the risks and advice for each risk.
• The IT-Label. The IT-Label assesses the digital infrastructure of a building in six areas. The physical layout of server and patch rooms falls under the infrastructure area. You also see whether a building has a second connection.
• Pre-inspection. A first look at where your building stands digitally, with the most important points for improvement.
• Digital Due Diligence. If you buy, sell or redevelop a building: a clear picture of the physical and digital infrastructure.
• IT-Label Smart Control. If you want the IT of a building to be monitored on a continuous basis, also after the inspection.

Frequently asked questions

Do physical hacks also happen at small businesses?

Yes. The well-known cases are often about banks and ports, but the method is simple and cheap. An open patch cabinet in a corridor or a network socket in a meeting room is a risk in every office.

What is a KVM switch?

A KVM switch is a small device that lets you control several computers with one keyboard, screen and mouse. With a mobile internet connection added, someone can control a computer remotely without anyone noticing.

Who is responsible for the technical rooms: the landlord or the tenant?

That depends on the agreements. Often the owner is responsible for the technical rooms of the building and the tenant for their own equipment. Record this in a demarcation list, so that it is clear who manages the key.

How do I know if there are strange devices on my network?

Ask your IT partner for an overview of all devices on the network, and compare it with what should be there. During a Security Audit, we also look for devices that are on the network without protection or that nobody knows about.

Does a second internet connection help against sabotage?

Yes, if it is truly independent: from a different provider, along a different route and through a separate entry point into the building. Two connections in the same cable duct fail together.

Know where your building is vulnerable

The criminals in these cases looked for the easiest way in. Make sure that way is closed in your building. Request a Security Audit or start with a pre-inspection.

Sources: The Register, Barclays and Santander (2014); The Register, Sumitomo Mitsui (2009); ASIS, port of Antwerp (2014); The Record, ruling of the Amsterdam Court of Appeal (2026); NASA OIG, report IG-19-022 (2019); Data Center Knowledge, Vodafone (2011); Deutsche Bahn, October 2022; Euronews, France (2024); Dutch Public Prosecution Service, mast fires; ZDF, Berlin power outage (2026); Bitkom, Wirtschaftsschutz 2024.