DOCUMENTING HYBRID WARFARE / — incidents / UPDATED LATEST: 
Sabotage Watch SABOTAGEWATCHHybrid Threat Monitor
Sabotage

Break-in and oil leak at the decommissioned Hamang substation

17 March 2025 · Bærum (Sandvika), Norway
Satellite Imagery © Esri

What happened

On the evening of Sunday 16 March 2025, a break-in and resulting oil leak were discovered at the decommissioned Gamle Hamang transformer station in Bærum, west of Oslo. According to grid operator Statnett, intruders cut through the perimeter fence and loosened a cover on a transformer, causing a large quantity of insulating oil to discharge. The fire service was alerted to a possible leak, after which Statnett investigated and confirmed the scale of the spill.

Statnett estimated that roughly 50 to 60 tonnes of transformer oil leaked from the unit. The leak was stopped after the loosened cover was tightened, and emergency crews began recovery work overnight, deploying absorbents and oil booms. A portion of the oil nonetheless seeped into the ground and reached the nearby Sandvikselva river, raising concerns over environmental damage given the toxicity of transformer oil to aquatic life.

The old Hamang station had been taken out of service in autumn 2024 after a replacement facility was commissioned, so the incident did not disrupt electricity supply. Statnett's project manager Thomas Fennefoss said it appeared someone had deliberately broken in and opened the transformer cover. Police opened an investigation into the break-in and appealed for tips, while cautioning that they did not yet have concrete evidence that the spill was an act of sabotage.

Assessment

Statnett described the break-in as a deliberate act and suspected sabotage of grid infrastructure, but Norwegian police emphasised they had no concrete evidence confirming sabotage and were still investigating. The targeting of a decommissioned station and the absence of any supply disruption complicate the picture, leaving motive unclear. The episode fits a broader pattern of heightened concern over the security of Western energy infrastructure, though on available evidence it should be treated as a suspected sabotage incident under investigation rather than a confirmed hostile act.

This dossier summarises open-source reporting and is updated as the investigation develops. Read the original report via the source link.