Denmark’s rail agency is facing uncomfortable questions after reports that a Moscow-based IT company, Saprun, had access to a system logging military transports on the railway.
According to ABC Nyheter, citing Danish outlet Ingeniøren, the information could include when Danish forces and NATO allies moved military equipment by train, including heavy gear such as tanks and missiles.
Banedanmark says the Russian supplier has had no access since Russia’s full-scale invasion of Ukraine in 2022, and there is no public evidence in the available sources that Saprun or Russian authorities misused the information. Still, the case lands at a sensitive moment.
Europe wants rail to carry more people and freight because it is cleaner, quieter, and less polluting than road transport, but those same tracks are also becoming part of NATO’s defense planning.
What Banedanmark says happened
According to the reports, Banedanmark worked for several years with Saprun, an IT company based in Moscow. The company reportedly had access to an IT system that logged information about military transports by rail, including movements involving Denmark’s armed forces and NATO allies.
Banedanmark’s press chief Andreas Hald told ABC Nyheter that the agency ended all agreements with Saprun immediately after Russia invaded Ukraine. He also said the supplier’s access has been “cut off since the outbreak of the war in 2022,” and that Banedanmark complied with the law when the contract was signed.
That is an important clarification, but it does not erase the bigger question. Why was a Russian IT supplier ever close to systems containing sensitive military movement data?
Why train data matters
A single train movement may not reveal much on its own. But patterns over weeks or months can show where equipment is going, how often it moves, and which routes matter most.
Think of it like footprints in fresh snow. One mark is just a mark, but a trail tells you where someone has been going every day. NATO now says allies need to move forces across alliance territory “quickly and efficiently,” which makes transport data more valuable than it may look at first glance.
For Denmark, geography adds another layer. The country can serve as a transit point for allied movement in northern Europe, especially toward the Baltic region and NATO’s eastern flank. In practical terms, a rail schedule can become intelligence if the wrong people can connect enough dots.
A defense link raises eyebrows
The case has also drawn attention because of reported links between Saprun’s parent company and Russia’s Tactical Missiles Corporation, known as KTRV. The U.S. Treasury describes KTRV as a large state-owned Russian defense conglomerate that produces weapons systems, including hypersonic weapons and anti-ship missiles.
U.S. authorities also sanctioned Boris Viktorovich Obnosov, KTRV’s general director, in 2022. That does not prove Saprun misused Danish rail data, and it should not be presented as proof. But it does show why supplier checks around critical infrastructure can no longer be treated like ordinary paperwork.
At the end of the day, this is not just about one contract. It is about whether governments fully understand who touches the digital systems behind railways, ports, energy grids, and other services people depend on every day.
The green rail angle
Rail is one of Europe’s strongest tools for cutting transport emissions. The European Environment Agency says transport accounted for about 31% of EU greenhouse gas emissions in 2023, while rail remained the lowest contributor and its emissions fell 73.7% from 1990 to 2023.
That is why governments want more freight and passengers on trains. Fewer trucks on the road can mean less exhaust, less noise, and fewer traffic jams that leave everyone breathing fumes on a hot afternoon.
But greener does not automatically mean safer. Modern railways run on digital layers, including signaling, maintenance software, traffic management, supplier platforms, and data logs. If those layers are weak, a climate-friendly transport system can become a tempting target.
Denmark has already warned us
Denmark’s own authorities have warned that the transport sector faces serious cyber risks. In an April 2025 assessment, the Danish Resilience Agency said the cyber espionage threat against the transport sector is “very high,” and the warning covers land, air, and rail transport.
The agency also said transport companies that supply the armed forces or take part in large tenders may be especially exposed. That line feels tailor-made for this case, even if the assessment was broader than Banedanmark alone.
The concerns are not only theoretical. In December 2024, Denmark’s National Audit Office said Banedanmark had “significant vulnerabilities” in the IT security of its signaling system and called the situation highly unsatisfactory.
It warned that IT incidents could disrupt or halt train operations, creating trouble for passengers, businesses, and possibly the wider economy.
What readers should keep in mind
The most important fact is also the most careful one. The available sources do not document misuse of the data by Saprun or Russian authorities.
Still, the lesson is clear. Green infrastructure is no longer only an environmental project, it is also a cybersecurity project, a defense project, and in some cases a business-risk problem for every supplier connected to critical systems.
That means stronger vetting, tighter access controls, better logging, and regular reviews when the geopolitical picture changes. No panic, just tougher questions before sensitive systems are handed to outside vendors.
The official transport sector threat assessment was published on SAMSIK, the Danish Resilience Agency’s cyber security site.
