Denmark Accuses Russia of Cyberattacks Targeting Infrastructure

In a significant development, Denmark has publicly attributed a series of cyberattacks to Russia, aimed at its water utility and government systems. The accusations stem from incidents in late 2024 and early 2025, which included attacks on a waterworks facility and government websites ahead of local elections.

Details of the Cyberattacks

According to Denmark’s Defence Intelligence Service, the pro-Russian hacking group known as Z-Pentest was responsible for targeting the Tureby Alkestrup Waterworks in late 2024. This assault manipulated water pressure and resulted in at least three pipeline bursts in Køge, located about 35 kilometers south of Copenhagen. As a result, 50 homes were left without water for seven hours, while an additional 450 households experienced a one-hour supply interruption.

Government Websites Under Siege

Another hacking group, NoName057(16), executed coordinated denial-of-service attacks on various Danish websites in November, coinciding with the lead-up to regional and local elections. Authorities have connected both hacking entities to the Russian state, asserting that they serve as tools in Russia’s hybrid warfare strategy against Western nations.

“The Russian state uses both groups as instruments of its hybrid war against the West,” stated Denmark’s intelligence agency.

Responses from Danish Officials

In light of these findings, Copenhagen summoned the Russian ambassador to express its concerns. Defence Minister Troels Lund Poulsen condemned the attacks, calling them “completely unacceptable.”

Lessons from the Attack

Jan Hansen, the head of the Tureby Alkestrup Waterworks, revealed that the cyberattack was made possible due to a switch in security systems to a less robust cybersecurity option. He advised other companies to prioritize cybersecurity investments and consider cyber insurance.

Potential Threats to Society

Denmark’s Minister of Resilience and Preparedness, Torsten Schack Pedersen, addressed the media, affirming that while the damages were limited, the attacks underscored the vulnerability of essential societal infrastructures.

Background on the Hacking Groups

Z-Pentest has been recognized by the US Justice Department as being founded, financed, and directed by Russia’s military intelligence agency, the GRU. This group emerged in September 2024 after dissatisfaction with another pro-Russian organization. Z-Pentest has a troubling history, having claimed responsibility for numerous attacks on critical infrastructures worldwide, including incidents in the United States.

NoName057(16)

This hacking group has been active since March 2022 and has engaged in frequent denial-of-service attacks against both government and private sectors in NATO countries and other European nations, utilizing Telegram channels to coordinate and recruit volunteers globally.

A Broader Russian Campaign

The incidents in Denmark are part of a wider trend of cyberattacks that Western officials associate with a Russian campaign aimed at sabotage across Europe. An Associated Press database has tracked 147 incidents of this nature. Notably, Norwegian authorities attributed an April attack on the Bremanger dam to pro-Russian hackers, highlighting the extended impact of these cyber threats.

International Reactions

Germany has also summoned the Russian ambassador in response to accusations of sabotage and election interference linked to cyberattacks on its air traffic control systems.

Conclusion

The attribution of these cyberattacks to Russia showcases growing concerns over the security of vital infrastructures in Europe. As tensions rise, the need for robust cybersecurity measures becomes more critical than ever.

Key Takeaways

• Denmark publicly attributes cyberattacks on its waterworks and government sites to Russian-backed hacking groups.
• Z-Pentest manipulated water infrastructure, causing significant disruptions.
• Officials emphasize the importance of strong cybersecurity defenses to prevent future incidents.
• These attacks reflect broader patterns of cyber warfare used by Russia against Western nations.