Two German Substations Went Down 41 Seconds Apart. Nothing Downstream Lost Power.
Berlin calls it sabotage and blames Moscow. The operator's own event recorder shows 418 megawatts crossing between the two stations in 380 milliseconds, to a connection point the register identifies by a code and by no name at all.
A months-long reporting project. Documents cited below are held in The Vault and available to readers.
DORTMUND, Germany — At 02:14:06 on 27 August a 380-kilovolt transformer at Höxter-Nord tripped. Forty-one seconds later one at Bad Driburg-Süd did the same.
Berlin has called this sabotage and pointed at Moscow, and it may be right about both.
It is not right about the outage, because there was not one. Nobody on either feeder lost power. Nobody dipped. Between the two trips, 418 megawatts of firm supply crossed from the first station to the second in 380 milliseconds and crossed back, and the only reason this newspaper can tell you that is that the operator sent us its own recorder trace when we asked.
What a trip usually looks like
When a transformer at this voltage drops, something goes dark. That is not a failure of the network; it is the network working. Load is shed, protection isolates the fault, and the lights come back in seconds or in hours depending on how bad the day is.
Nothing went dark. Not a street, not a works, not a pumping station. The distribution companies underneath both substations were asked and all four have confirmed it in writing.
A trip with no customer behind it is not an outage. It is a transfer.
The 380 milliseconds
We paid a protection engineer with twenty-two years on systems of this class to read the recorder trace without being told what we thought was in it.
She timed the transfer at 380 milliseconds — from the collapse of bus voltage at Höxter-Nord to full current at Bad Driburg-Süd — and volunteered, before we asked anything, that no scheme she has ever commissioned is permitted to move that fast.
The operator's own standard allows an automatic transfer 800 milliseconds and a manual one twelve minutes.
The operator's answer to this, printed in full below, is that beating your own limit by half is a sign of a scheme in good repair rather than a sign of anything else. It is a fair answer and this newspaper is not in a position to say it is wrong.
Who was on the other end
Every connection above 100 megawatts appears in the operator's connection register, published quarterly, free to download, with a network node in one column and an end customer in the next.
The end customer for both substations is R-9.
Not a company. Not a works. Two characters.
We coded sixty-two editions of that register by hand, back to 2011. Eleven entries carry an R- code in the end-customer field and nothing else. Together they hold 1,140 megawatts of firm capacity — more, on a still evening, than the city we filed this story from.
R-9 has been in the register since the third quarter of 2011 and has drawn power every day since. The capacity has been revised upward twice, in 2016 and in 2023.
What the regulator says the code is
The federal regulator confirms that the designation is lawful and describes it as a protected-customer entry: the operator must carry the load, meter it, bill it and publish the capacity, and is forbidden to publish the name.
Four of those five duties are visible in the register, which is why we could count the megawatts at all. The most transparent participant in this story is the company being written about, which is a poor incentive, and we would rather say so here than at the bottom.
The regulator's head of network access could not tell us which body holds the file that expands R-9 to a name. Neither could the operator's own director of network access, who has been asking for six years and says so, on the record, in her reply below.
The third feed
There is a third connection on the same designation: Warburg-West, listed as standby, energised twice in nine years.
Its circuit leaves the published network at what the operator calls a customer boundary. The register gives a node and stops.
We did not ask to go and look, because we asked in advance whether we would be allowed to and were told, courteously and immediately, that we would not.
What this desk takes from it
That the story Berlin is telling and the story the recorder is telling are about two different things, and only one of them has a trace.
Somebody may well have gone at these stations with a cutting tool. That question is open and we have not closed it. What the night of 27 August actually shows is a facility on the German transmission network large enough to matter, old enough to have been revised twice, and important enough that when its supply failed it was moved in under four tenths of a second so that it would not notice.
The register that says so has been public for fifteen years and costs nothing to download.
The recorder extract, our engineer's reading of it and our coding of the register are published with this story. If a reader can name R-9 from the public record, this newspaper will print that on the front page.
The six o'clock edition
Three stories a morning, in your inbox before the coffee is made.
Sources & Method
We asked the operator for its event-recorder extract for the ninety seconds around each trip, and it sent one. Then we paid a protection engineer to read the trace without being told what we thought was in it, and coded fifteen years of the operator's own quarterly connection register by hand to find every entry whose end customer is a code rather than a name.
Who we spoke to
- Nordwest Netzbetrieb AG, Transmission system operator, Dortmund. Written questions submitted 28 August 2026; full written response received 1 September, plus a ninety-minute technical briefing on the record August–September 2026 Supplied the event-recorder extract without being asked for it. Corrected two of our readings and was right about both.
- Dr. Roswitha Kellermann-Baptiste, Protection engineer, twenty-two years on 380kV systems; now consulting. Commissioned to read the recorder trace cold, without being told what the story was 31 August 2026 Timed the transfer at 380 milliseconds and said, before being prompted, that no protection scheme she has ever commissioned is permitted to move that fast.
- The connection register, 2011–2026, Published quarterly by the operator; sixty-two editions. Downloaded from the operator's own site; the eleven R- entries coded by hand and checked twice 2011–2026
- Bernhardt Oyelowo-Fricke, Federal grid regulator, head of network access. Interviewed in person, then by telephone; reviewed the draft 1 and 2 September 2026 Confirms the R- designation exists and is lawful. Would not say who administers the list, because he does not know.
What we could not confirm
- Who R-9 is. The end-customer field contains two characters. The regulator confirms the designation is lawful and could not tell us which body holds the file that expands it. We asked four organisations and were sent, between them, to two of the others.
- Whether anything was sabotaged at all. Two transformers tripped and the ministry says sabotage. We have the recorder trace, which shows the trips and shows the transfer, and a trace cannot tell you whether a hand was on the fence. We are not saying nobody attacked these stations. We are saying nobody went dark when they did.
- Where the 418 megawatts goes after Warburg-West. The register lists a node, not a destination, and the third feed leaves the published network at a point the operator describes to us as 'a customer boundary'. We have not been inside it and did not ask to be, because we were told in advance the answer would be no.
How Others Covered This
The same events, as reported elsewhere on the same day. We list what each outlet had that we did not, as well as what we had that they did not — including where we come off worse. Why we print this.
-
The Continental WireGermany Investigates Sabotage At Two Power Substations
Ran the ministry statement, the two station names and the word sabotage, within the hour.
Had that we did not
The official position, accurately, and the correct timestamps, which two other outlets got wrong by a minute.
Left out
That nobody lost power. Four paragraphs about an attack on the grid and not one line asking who went dark.
-
The Hollow PostTHEY ARE PRACTISING FOR THE BLACKOUT THEY HAVE ALREADY SCHEDULED
Read the two trips as a rehearsal for a continent-wide shutdown, dated to this winter.
Had that we did not
That the outage was not an outage. It was not, and this newspaper agrees.
Left out
That R-9 has been in the register since 2011 and has drawn power every day since, which makes it a customer rather than a countdown. A thing that has run for fifteen years is a facility.
-
They Buriedthis newspaperTwo German Substations Went Down 41 Seconds Apart. Nothing Downstream Lost Power.
Stopped reading the ministry and read the operator's own event recorder against its own connection register.
Had that we did not
The recorder trace entire, the eleven R- codes, and the two we misread before the operator corrected us.
Left out
The connection register is published quarterly and costs nothing. The R- codes have been sitting in the end-customer column since 2011 and this newspaper downloaded that file twice in 2024 for other stories. We had it. We did not read the column. — V. Ashcombe-Doyle, standards editor
Right of Reply
They Buried contacted Dr. Almuth Steinkamp-Vergara, director of network access, Nordwest Netzbetrieb AG Sent the full draft, the coded register and our engineer's reading of the trace; given six days. Asked that her answer run whole. Printed unedited.
I will start with the sentence you want and then take some of it back.
Yes. On the night of 27 August, 418 megawatts of firm supply moved from Höxter-Nord to Bad Driburg-Süd and back. Yes, it moved in 380 milliseconds. Yes, no household on either feeder recorded a disturbance, because none of them was ever going to: the load in question is not on a household feeder and never has been.
What I dispute is the word handover, and I dispute it on engineering grounds rather than on press-office grounds.
A transfer at 380 milliseconds is not a person throwing a switch and it is not a scheme rehearsing. It is two breakers doing exactly what an automatic transfer scheme is built to do when a bus voltage collapses, which is to reclose onto a healthy source before anything downstream notices. Your engineer is right that our commissioning standard allows 800 milliseconds. She is right because 800 is a limit, not a target, and a scheme that beats its limit by half is a scheme in good repair. I would be more worried if it had taken the full 800.
On R-9 I am going to disappoint you and then disappoint myself.
The designation is real, it is lawful, and it is not ours to lift. Certain connections are entered in the register under a protected designation. We are obliged to carry the load, meter it, bill it and publish the capacity, and we are prohibited from publishing the name. We have complied with all five obligations, including the fourth, which your story rather implies we have not.
And now the part I have been arguing with our counsel about for four days.
I do not know who R-9 is. I have been in this post for six years. I have asked. The file that expands the designation is not held by this company and I have written twice this year to the body I believe holds it, on an unrelated matter, and received an acknowledgement both times and an answer neither time.
I am carrying 418 megawatts to a customer I cannot name to you, and I cannot name them to myself either. You may print that, and you may print that I did not enjoy typing it.
Published unedited under our right-of-reply guarantee.
How was this story?
We publish the result, whatever it is. Reader verdicts appear on the front page and in our newsroom metrics.
Readers' Letters 0
Printed at once under the name you give and read by the desk afterwards; anything unfit is removed, with a note saying so, and nothing else is ever deleted — only corrected. Letters that changed something in the story carry a mark saying so, and there are 5 of those across the archive.