Danish intelligence says Russia conducted "destructive and disruptive" cyberattacks on a water utility in 2024 and on election websites in 2025, causing pipe bursts near Køge and temporary outages. The Defence Intelligence Service blamed pro-Russian groups Z-Pentest and NoName057(16), which it says have ties to the Russian state. Officials warned the incidents expose gaps in Denmark's preparedness and form part of a wider campaign of hybrid attacks since 2022.
Denmark Blames Russia for Cyberattacks That Burst Pipes and Crippled Election Websites
A map of disruption and sabotage staged by Russia, according to Western officials. (AP Digital Embed)
Danish authorities say a new intelligence assessment shows Russia carried out "destructive and disruptive" cyberattacks against Danish infrastructure and public websites in 2024 and 2025. The Defence Intelligence Service (FE) named pro-Russian hacking groups linked to the Russian state and warned the incidents reveal gaps in Denmark's preparedness.
What Happened
FE said Moscow was behind two distinct campaigns: a 2024 attack on a Danish water utility that reduced water pressure and caused pipes to burst near Køge — leaving some households temporarily without water — and a series of denial-of-service attacks last month that overwhelmed websites ahead of regional and local elections.
Who Is Responsible
The agency identified the group Z-Pentest as responsible for the "destructive attack" on the water utility and named NoName057(16) as behind the election-related website outages. FE said both groups have links to the Russian state and are being used as instruments in what it called a broader "hybrid war" against Western countries supporting Ukraine.
"The aim is to create insecurity in the targeted countries and to punish those that support Ukraine," the agency said in its statement.
Wider Context
Western officials say these Danish cases form part of a larger campaign of sabotage and disruption since Russia's 2022 invasion of Ukraine. An Associated Press database has catalogued 147 related incidents across Europe, though authorities note that linking attacks to Moscow can take months and not all incidents become public.
Denmark's minister for resilience and preparedness, Torsten Schack Pedersen, said the physical damage was limited but the incidents had serious implications for national security and public confidence. "It shows that there are forces capable of shutting down important parts of our society," he told reporters.
Regional Repercussions
The revelations come amid broader European concerns: Germany summoned Russia's ambassador to Berlin on Dec. 12 after accusing Moscow of sabotage, cyberattacks and election interference, including a reported 2024 cyberattack on German air traffic control.
What Officials Recommend
FE and Danish officials urged improvements to national cyber defences, incident response plans and infrastructure resilience. The assessment highlights the need for stronger protections for critical utilities and election infrastructure to reduce the risk of disruption and to preserve public trust.
