Denmark Russia cyberattacks linked to water utility and election sites

The Denmark Russia cyberattacks accusations mark a rare public attribution of destructive digital activity by Danish intelligence. Denmark’s Defence Intelligence Service (DDIS) has linked two serious cyber incidents to pro-Russian hacker groups, describing the operations as part of a broader campaign of hybrid warfare aimed at undermining national stability.

The assessment places cyberattacks alongside political pressure and influence operations as tools used to target countries supporting Ukraine.

What Danish intelligence says happened

According to the DDIS, one incident targeted a Danish water utility in 2024. Attackers manipulated control systems in a way that increased pressure in water pipes, causing physical damage and service disruption. Authorities described the attack as destructive rather than purely digital, as it interfered directly with critical infrastructure.

In a separate case, attackers launched distributed denial-of-service (DDoS) attacks against Danish public and government-related websites. These disruptions coincided with local and regional elections, temporarily taking sites offline and limiting public access to information during a politically sensitive period.

Groups linked to the attacks

Danish intelligence attributed the water utility attack to a pro-Russian group known as Z-Pentest. Investigators believe the group operates in alignment with Russian interests, even if it does not act under direct state command.

The DDoS attacks were linked to NoName057(16), a hacktivist collective that has repeatedly targeted European countries backing Ukraine. Security analysts widely view the group as part of Russia’s broader cyber ecosystem, operating with ideological motivation and strategic timing.

Political response in Denmark

Danish officials strongly condemned the attacks and described them as unacceptable interference. Defence Minister Troels Lund Poulsen said the incidents demonstrate how cyber operations now serve as instruments of hybrid warfare rather than isolated criminal acts.

Copenhagen announced plans to summon the Russian ambassador to address the findings. Officials also warned that public attribution reflects a deliberate decision to expose hostile activity rather than handle it quietly through intelligence channels.

Why Denmark calls this hybrid warfare

Hybrid warfare blends cyberattacks, influence operations, and psychological pressure to destabilize societies without triggering traditional military responses. Danish intelligence warned that such tactics aim to erode trust in public institutions, disrupt daily life, and create uncertainty around democratic processes.

The DDIS stressed that Denmark currently faces no immediate military threat, but cyber and hybrid operations remain persistent and difficult to deter. Authorities expect similar tactics to continue as geopolitical tensions remain high.

Broader European pattern

Denmark’s assessment mirrors concerns raised across Europe. Several EU countries and NATO members have reported cyber incidents linked to pro-Russian groups, often timed around elections, infrastructure projects, or political announcements related to Ukraine.

Security officials across the region increasingly view these campaigns as coordinated pressure efforts rather than independent hacking activity.

Conclusion

The Denmark Russia cyberattacks findings underline how cyber operations now form a central pillar of modern geopolitical conflict. By publicly linking infrastructure sabotage and election-period disruptions to pro-Russian actors, Denmark has signaled a tougher stance on attribution and transparency. The case highlights growing pressure on European states to strengthen cyber defenses and treat digital attacks as national security threats rather than isolated technical incidents.