Denmark Accuses Russia of Cyberattacks on Water Utility and Election Websites

Danish Intelligence Points to Russian State-Linked Groups

The Danish Defence Intelligence Service (DDIS) announced on Thursday, December 18, 2025, that Russia was behind two significant cyberattack campaigns targeting Danish critical infrastructure and democratic processes. The DDIS explicitly attributed a destructive cyberattack on a Danish water utility in 2024 to the pro-Russian group Z-Pentest, and a series of distributed denial-of-service (DDoS) attacks on Danish websites in the lead-up to the November 2025 municipal and regional council elections to the pro-Russian hacktivist group NoName057(16).

Danish officials have characterized these incidents as 'very clear evidence' of a 'hybrid war' being waged by Moscow against Western nations.

Details of the Water Utility Attack

The 2024 cyberattack on a water utility, attributed to Z-Pentest, targeted the Tureby Alkestrup Waterworks near the port town of Køge, located approximately 35 kilometers (22 miles) south of Copenhagen. Hackers reportedly manipulated pump pressure within the system, leading to three burst pipes. This disruption left around 50 households without water for several hours, while approximately 450 houses experienced a one-hour water outage. Jan Hansen, head of the Tureby Alkestrup Waterworks, indicated that the attack occurred after the utility switched to a cheaper, less secure cybersecurity solution.

DDoS Attacks Target Danish Elections

In November 2025, prior to the municipal and regional council elections, Danish websites experienced a wave of DDoS attacks. The DDIS attributed these attacks to NoName057(16), noting that the group specifically targeted websites of several Danish political parties, temporarily rendering them inaccessible. The intelligence service assessed that these attacks were designed to 'attract public attention' and exploit the electoral process, a pattern observed in other European elections.

Denmark's Response and International Context

Denmark's Defence Minister, Troels Lund Poulsen, condemned the cyberattacks as 'completely unacceptable,' stating that they underscore the reality of the hybrid warfare discussed in Europe. In response to the accusations, the Danish foreign office summoned Russia's ambassador to Copenhagen, Vladimir Barbin. Ambassador Barbin, however, rejected the allegations as 'unfounded' and 'unfair speculation,' claiming Denmark had provided no evidence of Russia's involvement.

The DDIS maintains that both Z-Pentest and NoName057(16) have connections to the Russian state and are utilized as instruments in Russia's broader 'hybrid war' strategy. The objective, according to Danish intelligence, is to 'create insecurity in the targeted countries and to punish those that support Ukraine.' Danish officials, including Minister for Resilience and Preparedness Torsten Schack Pedersen, acknowledged that while the damage from these attacks was limited, they revealed that Denmark is 'not sufficiently equipped' to withstand such state-level cyber threats. These incidents align with a global cybersecurity advisory issued by multiple international agencies, warning about pro-Russian hacktivist groups targeting critical infrastructure worldwide.