Luxembourg is taking part in Europe's biggest cyber drill — here's why it matters to you

On 10–11 June, Luxembourg joins a continent-wide simulation of a coordinated cyberattack on trains and ports. No real disruption — but the stakes are very real.

 8 June 2026 3 min read

WHAT'S HAPPENING

This week, Luxembourg's trains could be hit by a major cyberattack — at least in a simulation. On Tuesday and Wednesday, the country participates in Cyber Europe 2026, a large-scale pan-European exercise organised every two years by the EU's cybersecurity agency, ENISA. This is the eighth edition since the exercise began in 2010, and the first to focus specifically on the transport sector — railways and maritime infrastructure.

No real trains or services will be affected. The exercise runs entirely on simulated systems, with no impact on actual infrastructure or passengers.

WHY RAILWAYS AND PORTS?

Railways and ports are what security experts call "critical infrastructure" — systems that, if disrupted, can rapidly affect the daily lives of millions. A cyberattack on signalling systems, booking platforms, or cargo logistics doesn't just inconvenience commuters; it can cascade into fuel shortages, supply chain failures, and public safety emergencies. Recent years have seen real-world cyberattacks on rail networks across Europe, making this scenario far from hypothetical.

Train signalling & booking systemsMaritime cargo logisticsCrisis communication to the publicCross-border coordination

WHO IS INVOLVED IN LUXEMBOURG

The exercise mobilises eight major national actors, coordinated by the High Commissioner for National Protection (HCPN):

• HCPN — national coordination of the exercise
• GOVCERT & CIRCL — government and private-sector cyber incident response teams
• CFL & ACF — Luxembourg's national railway and railway administration
• Ministry of Mobility and Public Works — policy and transport oversight
• ILR & ILNAS — regulatory and standards bodies

WHAT DOES THE EXERCISE ACTUALLY TEST?

The simulated attack is designed to be realistic and multi-layered — combining different attack techniques simultaneously, the way real hostile actors operate. Teams are judged not just on whether they can detect and contain the attack technically, but on how well they communicate under pressure: with each other, with the public, and with European partners. Panic and misinformation during a real crisis can be as damaging as the attack itself.

"A key issue in a complex media and information environment" — that's how national authorities describe the communications challenge. In other words, telling the public the right thing, at the right time, without creating unnecessary alarm is a skill that needs rehearsing too.

THE BIGGER PICTURE

Cyber Europe 2026 brings together hundreds of public and private organisations across all EU member states and beyond. Luxembourg's participation is part of its National Resilience Strategy and the Lëtzprepare initiative — the country's broader programme for being ready for major crises, from flooding to cyberattacks.

The NIS2 Directive, the EU's updated cybersecurity law, now legally requires operators of critical infrastructure — including transport — to meet tougher security and incident-reporting standards. This exercise is a direct test of whether those obligations translate into real preparedness.

WHAT THIS MEANS FOR YOU

You won't notice anything on 10–11 June — that's the point. But the next time CFL's app goes down, a train is delayed by a "technical issue," or European ports grind to a halt after a suspicious IT outage, the agencies drilled this week will be the ones on the front line. Exercises like this are what the gap between a brief disruption and a prolonged crisis looks like in practice.