In December 2025, the Danish Defense Intelligence Service publicly attributed two major destructive cyber-attacks to Russian state-linked groups, Ghostwriter and NoName057(16). These attacks occurred in 2024 and 2025, targeting Danish state IT systems and municipal water infrastructure, including a significant incident in Køge that resulted in hackers disrupting water supply safety by manipulating valves and pressure. The Danish defense minister emphasized the seriousness and ongoing risk, highlighting insufficient national preparedness against such hybrid warfare. The attacks are understood as part of Russia’s strategy to undermine support for Ukraine and destabilize European countries. This follows recent drone incursions at Danish airports and other military-related provocations. Denmark has condemned these acts and called for diplomatic responses, including summoning the Russian ambassador to protest these unacceptable cyber operations, which form part of Russia’s broader hybrid war campaign.

In December 2025, the Danish Defense Intelligence Service publicly attributed two major destructive cyber-attacks to Russian state-linked groups, Ghostwriter and NoName057(16). These attacks occurred in 2024 and 2025, targeting Danish state IT systems and municipal water infrastructure, including a significant incident in Køge that resulted in hackers disrupting water supply safety by manipulating valves and pressure. The Danish defense minister emphasized the seriousness and ongoing risk, highlighting insufficient national preparedness against such hybrid warfare. The attacks are understood as part of Russia’s strategy to undermine support for Ukraine and destabilize European countries. This follows recent drone incursions at Danish airports and other military-related provocations. Denmark has condemned these acts and called for diplomatic responses, including summoning the Russian ambassador to protest these unacceptable cyber operations, which form part of Russia’s broader hybrid war campaign.