Denmark blames cyberattacks on groups tied to Russian state

By Camille BAS-WOHLERT
Copenhagen (AFP) Dec 18, 2025

Denmark on Thursday accused two hacker groups linked to the Russian state of carrying out two cyberattacks, one on a Danish water treatment plant in 2024 and one on local elections last month.

The government said it would summon the Russian ambassador over the matter, Defence Minister Troels Lund Poulsen told a press conference.

Water pipes were exploded in the 2024 incident -- attributed to pro-Russian group Z-Pentest -- in which household water supply was briefly affected, he said.

The country's environmental agency at the time said the attack was quickly detected, but "underscored that cyberattacks can affect security of supply".

The second attack occurred on the eve of Denmark's municipal and regional elections in November, when the websites of several political parties, municipalities, public institutions and a defence company were inaccessible due to a cyberattack claimed by the Russian hacker group NoName057.

"We are very confident that these are pro-Russian groups linked to the Russian state," said the head of Denmark's military intelligence agency (FE), Thomas Ahrenkiel.

FE said in a statement that the Russian state uses both NoName057 and Z-Pentest "as instruments of its hybrid war against the West".

"The aim is to create insecurity in the targeted countries and to punish those that support Ukraine," it said.

"Russia's cyber operations form part of a broader influence campaign intended to undermine Western support for Ukraine."

Both attacks caused limited damage, but highlighted vulnerabilities, according to Denmark's Minister for Resilience and Preparedness, Torsten Schack Pedersen.

"This shows that there are forces capable of bringing essential services in our society to a halt."

- 'Very serious' -

Denmark is one of Ukraine's most ardent supporters, as illustrated earlier this month with a groundbreaking ceremony for the construction of a Ukrainian arms factory on Danish soil.

In late September, unidentified drones flew over several Danish airports and the Skrydstrup air base -- where Ukrainian pilots are trained on F-16 fighter jets.

Danish Prime Minister Mette Frederiksen pointed the finger at Moscow for the overflights, saying Russia posed "a threat to Europe's security".

The government said Thursday it intended to beef up measures to protect the country.

"We have taken numerous initiatives and we will take more, because Russia's way of acting is profoundly unacceptable," Lund Poulsen said.

He said the government would set up a new cyber-surveillance network and an online operations centre to quickly respond to threats, among other things.

"It's very serious to be able to attribute the attacks to the Russian state. That it's not just sympathisers, but a group directly linked to the Russian state. This underscores that the situation is particularly grave," Schack Pedersen told public broadcaster DR.

"We are not in a state of war, we are not in a state of peace, but we are in hybrid warfare," he said.

Cyberattacks were expected to continue despite the government's best efforts, he warned.

"You'd have to be incredibly naive to believe we've achieved our cybersecurity goal."