Denmark accuses Russia of cyberattacks on water utility and election websites

Russia accused of cyber sabotage

Russian cyberattacks targeted Danish infrastructure and websites in 2024 and 2025, Danish authorities reported this week, revealing previously unreported incidents.

Moscow was behind “destructive and disruptive” attacks on a Danish water utility in 2024 and a series of denial-of-service assaults that overwhelmed websites ahead of recent regional and local elections, the Danish Defense Intelligence Service said Thursday. The water company added that the attack caused pipes to burst, temporarily leaving homes without water.

Jan Hansen, head of Tureby Alkestrup Waterworks southwest of Copenhagen, advised other companies “not to cut costs on cybersecurity and to take out cyber insurance.” He said the attack occurred because the waterworks had switched to cheaper, less secure cybersecurity measures.

The Danish intelligence service described the attacks as part of Russia’s “hybrid war” against the West and an effort to create instability. It added that Moscow’s cyberattacks are part of a broader campaign to undermine and punish countries supporting Ukraine. Russian hackers have previously targeted other European water facilities, including a Norwegian dam where authorities said valves were opened, causing water to pour out.

Torsten Schack Pedersen, Denmark’s minister of resilience and preparedness, said the attacks caused limited damage but had serious implications.

“It shows that there are forces capable of shutting down important parts of our society," he said at a Thursday news conference, according to Danish broadcaster DR.

Schack Pedersen also noted that the cyberattacks revealed that Denmark “is not sufficiently equipped to handle such situations,” DR reported.

The attacks are among a growing number of incidents that Western officials say are part a campaign of sabotage and disruption across Europe masterminded by Russia. An Associated Press database has documented 147 incidents, including the two cases reported by Denmark this week.

Not all incidents are public and it can sometimes take officials months to establish a link to Moscow. While officials say the campaign — waged since President Vladimir Putin’s invasion of Ukraine in 2022 — aims to deprive Kyiv of support, they believe Moscow is also trying to identify Europe's weak spots and suck up law enforcement resources.

The Danish agency said pro-Russian group Z-Pentest carried out the “destructive attack” on the water utility company in 2024 and that a separate group, NoName057(16), was responsible for the cyberattack on Danish websites ahead of the recent elections. It said both have links to the Russian state.

“The Russian state uses both groups as instruments of its hybrid war against the West. The aim is to create insecurity in the targeted countries and to punish those that support Ukraine,” the statement said. NoName057(16) acted, authorities said, in November to disrupt the elections, according to DR.

The Tureby Alkestrup Waterworks serves several villages some 35 kilometers (22 miles) south of Copenhagen. The waterworks said the hackers changed the water pressure, which caused a pipe to burst. It said about 50 households were without water for around seven hours while around 450 houses had no water for one hour.

In Germany, meanwhile, authorities summoned Russia's ambassador in Berlin on Dec. 12 after the foreign ministry accused Moscow of carrying out sabotage, cyberattacks and election interference.

That included a 2024 cyberattack against German air traffic control, German Foreign Ministry spokesperson Martin Giese said.