Ics – Tureby-Alkestrup Vandværk (Køge)

In the days before Christmas Eve 2024, attackers gained control of the control systems at Tureby-Alkestrup Vandværk, a small waterworks south of Køge, and manipulated pump pressure until three water pipes burst. Hundreds of households were left without water for up to seven hours.

This is the first known case of a cyber attack causing physical damage on Danish soil. It is also the clearest available demonstration that small Danish utilities — operating with minimal IT security, no incident response plan, and internet-exposed OT — sit inside the same threat model as the large operators.

In December 2025, Forsvarets Efterretningstjeneste publicly attributed the attack to the pro-Russian group Z-Pentest and assessed it as connected to the Russian state. The Danish Ministry of Foreign Affairs summoned Russian ambassador Vladimir Barbin; Russia rejected the assessment. The EU subsequently sanctioned Z-Pentest and Yuliya Pankratova, the group's leader and part of the Cyber Army of Russia Reborn (CARR), which is linked to the GRU.

Roughly six months after the attack, CFCS raised Denmark's threat level for destructive cyber attacks from LOW to MEDIUM.

Date note: Reported only as shortly before Christmas Eve 2024. The date field is set to 2024-12-23 as a best approximation.

• Forsvarets Efterretningstjeneste — Rusland er ansvarlig for destruktive og forstyrrende cyberangreb mod Danmark
• FE — Russia is responsible for destructive and disruptive cyber attacks (PDF, EN)
• DR — Kort før juleaften angreb hackere et lille vandværk og sprængte rørene
• DR — FE tilskriver cyberangreb pro-russere med forbindelse til staten
• DR — Cyberangreb mod vandværk ved Køge udløser EU-sanktioner
• Ingeniøren — Vandværk ramt af cyberangreb: Borgere uden vand i flere timer
• TV 2 — Tre sprængte vandrør ændrede Danmarks syn på cyberangreb
• Version2 — Åbne porte og manglende opdateringer: Danske vandværker mangler basal it-sikkerhed