// CTI League

Incidents

Curated Danish cybersecurity incidents, sorted by year and month.

incidents

Suggest an incident

2025

2 incidents

November

11.

DDoS

Danish municipalities and public authorities

Public SectorActor: NoName057(16)

January

14.

Data Leak

Danish Fortinet customers (incl. DSV, Mærsk, Rigspolitiet)

Multiple / Cross-sectorActor: Belsen Group

2024

3 incidents

December

23.

ICS / OT

Tureby-Alkestrup Vandværk (Køge)

Water / Critical InfrastructureActor: Z-Pentest (pro-Russian, linked to the Russian state by FE)

09.

DDoS

Danish municipalities and KL

Public SectorActor: NoName057(16)

May

31.

Ransomware

Odense Universitetshospital (via IT-Hotellet)

Healthcare

2023

4 incidents

November

01.

Ransomware

EDC

Real EstateActor: Black Basta

August

18.

Ransomware

CloudNordic / AzeroCloud

IT / Hosting

May

11.

Hacking

Danish energy and heating sector (22 companies)

Energy / Critical InfrastructureActor: Disputed — see below

January

10.

DDoS

Multiple Danish financial institutions

FinanceActor: Killnet / NoName057(16) — see below

2022

12 incidents

October

29.

Hacking

Supeo (DSB supplier)

Software Development

August

09.

Ransomware

Ista Danmark A/S

EnergyActor: Daixin Team

08.

Ransomware

7-Eleven Danmark

June

April

JBS Textile Group

Retail / ClothingActor: Black Basta

March

29.

Unknown

Daka Denmark

Recycling

19.

Ransomware

Nordex Food

Food / Cheese ProductionActor: Conti

13.

Ransomware

Scanvogn

Manufacturing / ConstructionActor: LockBit 2.0

01.

Ransomware

Lifa

Land Surveying / EngineeringActor: Conti

February

04.

Ransomware

Support IT A/S (SIT)

IT / MSP

2021

7 incidents

December

22.

Unknown

Würth Danmark

Retail

November

20.

Ransomware

Vestas A/S

Energy / ManufacturingActor: LockBit 2.0

October

29.

Ransomware

Illum

RetailActor: Conti

July

03.

Supply chain

Multiple Danish organisations (Kaseya VSA)

IT / MSP and customersActor: REvil

June

22.

Ransomware

Bauhaus

RetailActor: Unknown (Russian-linked)

09.

Ransomware

Tech Hotel

Hospitality / Software

04.

Ransomware

Kompan A/S

Manufacturing (playground equipment)Actor: Conti

2020

6 incidents

December

13.

Supply chain

Multiple Danish organisations (SolarWinds)

Public and private sectorActor: APT29 (Cozy Bear)

November

24.

Ransomware

Ritzau

Media / News Agency

April

19.

Ransomware

Danish Agro

Agriculture / Food

07.

Ransomware

Desmi

Industrial / Manufacturing

February

17.

Ransomware

ISS A/S

Facility Management

07.

Data Leak

Skatteforvaltningen (TastSelv Borger / DXC Technology)

Public Sector / TaxActor: None (software defect)

2019

1 incident

September

03.

Ransomware

Demant (Oticon)

Medical Devices

2017

1 incident

June

27.

Ransomware

Mærsk

LogisticsActor: NotPetya

2012

1 incident

April

01.

Hacking

CSC Danmark (Rigspolitiet)

Public Sector / IT OutsourcingActor: Gottfrid Svartholm Warg + Danish co-defendant

Incidents

2025

Danish municipalities and public authorities

Danish Fortinet customers (incl. DSV, Mærsk, Rigspolitiet)

2024

Tureby-Alkestrup Vandværk (Køge)

Danish municipalities and KL

Odense Universitetshospital (via IT-Hotellet)

2023

EDC

CloudNordic / AzeroCloud

Danish energy and heating sector (22 companies)

Multiple Danish financial institutions

2022

Supeo (DSB supplier)

Ista Danmark A/S

7-Eleven Danmark

Lokaltog A/S

Actas A/S

Gyldendal Uddannelser

JBS Textile Group

Daka Denmark

Nordex Food

Scanvogn

Lifa

Support IT A/S (SIT)

2021

Würth Danmark

Vestas A/S

Illum

Multiple Danish organisations (Kaseya VSA)

Bauhaus

Tech Hotel

Kompan A/S

2020

Multiple Danish organisations (SolarWinds)

Ritzau

Danish Agro

Desmi

ISS A/S

Skatteforvaltningen (TastSelv Borger / DXC Technology)

2019

Demant (Oticon)

2017

Mærsk

2012

CSC Danmark (Rigspolitiet)