Denmark / 2024-12-dk-1
/ date of the event / day not established
In December 2024, shortly before Christmas, hackers took control of the pumps of the small Tureby-Alkestrup waterworks in Køge Municipality and raised the pressure until pipes burst in three places; hundreds of households were without water for up to seven hours. The sources do not give the day, hence month precision. The waterworks' board admitted that remote access had been poorly secured. On 18 December 2025 the head of the Danish Defence Intelligence Service (FE), Thomas Ahrenkiel, said the service was very confident that pro-Russian groups connected to the Russian state were behind the attack and named the group Z-Pentest; the government summoned the Russian ambassador. On 13 July 2026 the Council of the EU sanctioned Z-Pentest, its leader and its main hacker, linking the CARR grouping they belong to with Russia's military intelligence, the GRU. Nobody has been convicted.
suspected
Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Named party: the pro-Russian hacker group Z-Pentest, connected to the Russian state according to the FE
C - official suspicion
Forsvarets Efterretningstjeneste (FE, duński wywiad wojskowy) / 2025-12-18 / carrying out the act
The head of the FE said at a press conference that the service assesses it as very likely that pro-Russian groups connected to the Russian state were behind the attack, and named Z-Pentest. This is an intelligence assessment, not a verdict or a charge; no specific organ of the Russian state was named as having ordered it.
Rada Unii Europejskiej / 2026-07-13 / carrying out the act
The Council of the EU sanctioned Z-Pentest for the December 2024 cyber-attack on a Danish water utility, together with the group's leader and its main hacker, both from the CARR grouping, which the Council links to Russia's military intelligence, the GRU. Sanctions are a political and legal decision of the member states, not a court finding.
No casualties reported.
pending editorial review
water outage: area served by the Tureby-Alkestrup waterworks, Køge Municipality
minutes of disruption: 420
Malcontent gives November 2024. DR, TV 2 and the Council of the EU speak of December 2024 ("shortly before Christmas Eve"). December is adopted; no source gives the day.
The FE publicly attributed the attack to Z-Pentest; the Danish foreign ministry summoned the Russian ambassador.
The Council of the EU imposed sanctions on Z-Pentest and on Yuliya Pankratova and Denis Degtyarenko over the attack on the Danish waterworks.
DR / 2025-12-18 / secondary source
supports: the attribution, the record
DR / 2025-10-03 / secondary source
supports: the record, the date, the impact, the location
DR / 2026-07-14 / secondary source
supports: the impact, the disruption, the attribution
Council of the European Union / 2026-07-13 / primary source
supports: the attribution
TV 2 Kosmopol / secondary source
supports: the attribution
TV 2 / 2025-12-18 / secondary source
supports: the record, the impact
AP News / secondary source
supports: the record