{
  "id": "39e79b95-9cd2-4df0-8bf3-af0cd6e037b2",
  "url": "https://sverigesradio.se/artikel/civil-defence-minister-sweden-foiled-pro-russian-cyber-attack-on-heating-plant",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Sweden",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "cyber attack",
    "pro-russian groups",
    "critical infrastructure",
    "heating plant",
    "Swedish Intelligence Service",
    "operational systems",
    "hybrid warfare"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Sweden"
  ],
  "where_text": "Cyberspace",
  "headline": "Sweden foiled pro-Russian cyber attack on district heating plant in spring 2025",
  "description": "In spring 2025, Sweden's Civil Defence Minister Carl-Oskar Bohlin disclosed that Swedish authorities foiled a pro-Russian cyber attack targeting a district heating plant in western Sweden. The Swedish Intelligence Service investigated the incident, identified the perpetrator as a pro-Russian actor, and prevented any serious consequences by activating built-in protection mechanisms. The attack represents a shift in Russian cyber tactics, targeting operational systems controlling critical infrastructure rather than conventional IT networks.",
  "summary_short": "Sweden prevented a pro-Russian cyber attack on a district heating plant in western Sweden during spring 2025, according to Civil Defence Minister Carl-Oskar Bohlin.",
  "summary_extended": "The Civil Defence Minister of Sweden, Carl-Oskar Bohlin, revealed that a cyber attack attributed to pro-Russian actors on a western Swedish district heating plant was foiled in spring 2025. The Swedish Intelligence Service successfully handled the case and identified the attacker, preventing any significant damage due to a protective mechanism within the operational systems. Bohlin highlighted that this incident illustrates a change in Russia's cyber modus operandi, focusing on operational technology systems that control critical infrastructure, marking a departure from traditional cyber attacks. This event underscores ongoing hybrid threats to Sweden's critical infrastructure safety.",
  "actor_primary": "Swedish Intelligence Service",
  "target_primary": null,
  "location_text": "Western Sweden district heating plant",
  "location_region": "Western Sweden",
  "location_coordinates_lat": 60.128161,
  "location_coordinates_lon": 18.643501,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly states a pro-Russian cyber attack attempt against Swedish critical infrastructure was identified and foiled by Swedish authorities, confirming aggressor activity by Russia. There is no mention of defensive preparations beyond incident handling.",
  "event_time_utc": "2025-04-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-15T18:25:00.261Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "39e79b95-9cd2-4df0-8bf3-af0cd6e037b2",
  "url": "https://sverigesradio.se/artikel/civil-defence-minister-sweden-foiled-pro-russian-cyber-attack-on-heating-plant",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Sweden",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "cyber attack",
    "pro-russian groups",
    "critical infrastructure",
    "heating plant",
    "Swedish Intelligence Service",
    "operational systems",
    "hybrid warfare"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Sweden"
  ],
  "where_text": "Cyberspace",
  "headline": "Sweden foiled pro-Russian cyber attack on district heating plant in spring 2025",
  "description": "In spring 2025, Sweden's Civil Defence Minister Carl-Oskar Bohlin disclosed that Swedish authorities foiled a pro-Russian cyber attack targeting a district heating plant in western Sweden. The Swedish Intelligence Service investigated the incident, identified the perpetrator as a pro-Russian actor, and prevented any serious consequences by activating built-in protection mechanisms. The attack represents a shift in Russian cyber tactics, targeting operational systems controlling critical infrastructure rather than conventional IT networks.",
  "summary_short": "Sweden prevented a pro-Russian cyber attack on a district heating plant in western Sweden during spring 2025, according to Civil Defence Minister Carl-Oskar Bohlin.",
  "summary_extended": "The Civil Defence Minister of Sweden, Carl-Oskar Bohlin, revealed that a cyber attack attributed to pro-Russian actors on a western Swedish district heating plant was foiled in spring 2025. The Swedish Intelligence Service successfully handled the case and identified the attacker, preventing any significant damage due to a protective mechanism within the operational systems. Bohlin highlighted that this incident illustrates a change in Russia's cyber modus operandi, focusing on operational technology systems that control critical infrastructure, marking a departure from traditional cyber attacks. This event underscores ongoing hybrid threats to Sweden's critical infrastructure safety.",
  "actor_primary": "Swedish Intelligence Service",
  "target_primary": null,
  "location_text": "Western Sweden district heating plant",
  "location_region": "Western Sweden",
  "location_coordinates_lat": 60.128161,
  "location_coordinates_lon": 18.643501,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly states a pro-Russian cyber attack attempt against Swedish critical infrastructure was identified and foiled by Swedish authorities, confirming aggressor activity by Russia. There is no mention of defensive preparations beyond incident handling.",
  "event_time_utc": "2025-04-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-15T18:25:00.261Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}