When a Danish waterworks’ pipes burst after a cyberattack, the country’s water supply was briefly halted, prompting a nationwide investigation into Russian-linked hackers.
2024 Waterworks Attack
In 2024, Moscow carried out a destructive cyberattack on the Tureby Alkestrup Waterworks, located 35 kilometres south of Copenhagen. The hackers altered water pressure, causing a pipe to burst. About 50 households were without water for roughly seven hours, while around 450 houses lost water for one hour.
Jan Hansen, the head of the waterworks, advised other companies: “not to cut costs on cybersecurity and to take out cyber insurance.” He blamed the attack on the waterworks’ switch to cheaper, less secure cybersecurity.
2025 Website Disruptions
Earlier this year, a separate group launched a series of denial-of-service attacks that overwhelmed Danish websites ahead of regional and local elections. The attacks were carried out in November and were designed to disrupt the electoral process.
The Danish Defense Intelligence Service linked the attacks to the group NoName057(16), which has ties to the Russian state.
Attribution and Motive
The intelligence service identified the destructive attack on the waterworks as the work of the pro-Russian group Z-Pentest, while the website disruptions were attributed to NoName057(16). Both groups are said to operate under Russian state direction as part of a broader hybrid war aimed at destabilising countries that support Ukraine.
Torsten Schack Pedersen, Denmark’s minister of resilience and preparedness, said: “It shows that there are forces capable of shutting down important parts of our society,” and added that Denmark is not sufficiently equipped to handle such situations.
Broader Context and Response
The attacks are part of a growing list of incidents that Western officials say are a campaign of sabotage and disruption across Europe masterminded by Russia. An Associated Press database documents 147 incidents, including Denmark’s two cases reported this week. The campaign, which began after President Vladimir Putin’s invasion of Ukraine in 2022, seeks to deprive Kyiv of support and to expose Europe’s weak points.
In Germany, authorities summoned Russia’s ambassador on Dec. 12 after the foreign ministry accused Moscow of sabotage, cyberattacks and election interference, including a 2024 cyberattack against German air traffic control.
Key Takeaways
- A 2024 cyberattack on a Danish waterworks caused pipe bursts and a brief water outage.
- 2025 denial-of-service attacks disrupted Danish websites ahead of elections.
- Russian-linked groups Z-Pentest and NoName057(16) were identified as the perpetrators.
Denmark’s investigation underscores the growing threat of state-backed cyber operations across Europe.
