Tureby-Alkestrup waterworks pump-control attack, Denmark, 2024

What happened. Over two days shortly before Christmas 2024, an intruder reached the pump controls of Tureby-Alkestrup Vandværk, a small consumer-owned waterworks south of Copenhagen, through an internet-exposed remote-desktop session protected by a four-digit PIN[1]. The pumps were first set to zero, cutting water to about 450 households for about an hour, then set to 100 percent, bursting a pipe and leaving about 50 households without water for about seven hours[1][2].

Why it matters. It is the first case in DeNexus’s incident records of physical damage caused by the pro-Russia groups that work through exposed operator screens, and Denmark’s Defence Intelligence Service has attributed it to one of them[3].

About this analysis. This analysis sets out what is known, stage by stage. The account of the attack is the waterworks chairman’s own; the attribution is a public intelligence assessment that does not name the utility. This account reflects the best available information as of November 2, 2026; new information could confirm, change or discredit parts of it.

Highlights

The works had replaced its control-system vendor’s secure remote connection with a cheaper set-up: a standard modem with a port forward, VNC Viewer and a four-digit PIN[1]. Bloomberg quotes the chairman that the password was “1234”[4].
Over-pressure burst one large and one smaller pipe, and a further leak was found later. The pumps were locked until the vendor restored them within three to four hours[1].
In December 2025, the Danish Defence Intelligence Service attributed “a destructive cyber-attack on a Danish water utility in 2024” to Z-Pentest, a pro-Russian group it assesses has links to the Russian state; the press identified the utility as Tureby-Alkestrup[3][2].
Repairs, leak tracing and new security cost “several hundred thousand kroner”, and the works had no cyber insurance[1].

Attack flow

Updated: 2026-11-02
Intent: Malicious [confirmed]
Threat actors: Hacktivists [confirmed | Z-Pentest, per DDIS]; Nation-State [reported | State links assessed by DDIS]
Access vector: Internet Accessible Device [confirmed | T0883, exposed VNC]; Default / Weak Credentials [confirmed | Four-digit PIN]
IT impact: Not in path [not in path | No IT network involved]
OT targeting: Direct OT Compromise [confirmed]
OT sophistication: Crude [confirmed]
OT impact: Manipulate Control [confirmed | T0836, T0831]; Loss / Denial of Control [confirmed | T0813]
Perils: Pressure Failure [primary]; Loss of Containment [secondary]
Financial losses: Assets & Equipment [confirmed]; Cyber-Physical Incident Response [confirmed]; Business Interruption [confirmed]; Cyber Incident Response [confirmed]

What happened

Tureby-Alkestrup Vandværk supplies about 450 households in two villages in Køge Municipality, about 35 km south of Copenhagen[1][2]. Its pump controls, a small SRO system (the Danish term for SCADA), had been reachable through the SRO vendor’s secure connection. When renewal costs came up, the works switched to a cheaper arrangement from another company: a standard telecom modem with a fixed IP address and a port forward, reached with VNC Viewer[1].

The attack came over two consecutive days. The waterworks says shortly before Christmas and Bloomberg says mid-December; no source gives the dates[1][4]. First the pressure on all pumps was set to manual at zero percent. Staff corrected it shortly afterwards, but about 450 households had no water for roughly an hour. The next day an alarm reported a pressure problem: the pressure had been set to 100 percent, and a water pipe burst. About 50 households were without water for roughly seven hours while it was repaired[1].

The pumps were also locked. The works could restart them remotely the first day but not the second, and the operations manager who drove to the site could not restart them either; the SRO vendor restored them within three to four hours[1]. Bloomberg adds that the control panel became inaccessible to the chairman, Jan Hansen, that a pump was found “running out of control”, and that technicians from Evotect ApS, the controller’s maker, determined the system had been hacked[4]. The Danish Defence Intelligence Service visited the day after the attack and took IT equipment away for examination[5].

On December 18, 2025, the intelligence service attributed the attack to Z-Pentest, without naming the utility, and Denmark summoned the Russian ambassador[3][6].

Intent: malicious

The setpoints were changed deliberately, in both directions, on two consecutive days, and the pumps were locked against restart[1]. “They got into our control system and set all the pumps to run at 100 percent,” the chairman said[7]. No ransom demand is reported. The intelligence service says Russia uses Z-Pentest and a second group as instruments of its hybrid war, with the aim “to create insecurity in the targeted countries and to punish those that support Ukraine”[3].

Threat actors: a pro-Russian group, attributed

On December 18, 2025, the Danish Defence Intelligence Service (DDIS) said it “assesses” that Z-Pentest, a pro-Russian group with links to the Russian state, carried out “a destructive cyber-attack on a Danish water utility in 2024”[3]. The statement does not name the utility and gives no confidence level; AP, Euronews and Danish media identified it as Tureby-Alkestrup[2][6]. TV 2 Kosmopol says the group bragged about the attack on X; the post itself was not located[7].

A US joint advisory says Z-Pentest formed in September 2024 from members of Cyber Army of Russia Reborn (CARR) and NoName057(16)[8]. The US Justice Department treats CARR and Z-Pentest as one group that it alleges the GRU founded, funded and directed; those are allegations in an indictment[9]. The map shows Z-Pentest as a hacktivist group on the Danish attribution, and the state link as reported. No individual is named.

Access vector: an exposed remote-desktop session

The waterworks’ own account is specific. The pump-control system was reachable from the internet through a standard modem with a fixed IP address and a port forward, over VNC Viewer, protected by a simple four-digit PIN[1]. “We had chosen a cheaper remote access solution, which turned out to be far too insecure,” the chairman said[1]. Bloomberg quotes him that the password was “1234”[4]. Neither says the PIN was a factory default, so a weak credential is confirmed but a default one is not.

The account deliberately does not describe the attacker’s exact method[1]. It matches the pattern the US advisory describes for these groups: scanning for exposed VNC, guessing the password and changing settings through the operator screen[8].

IT impact: not in this attack’s path

No IT network was involved. The attacker reached the control system directly from the internet over VNC, and no source describes phishing, malware or any office system being touched[1]. The computers the works bought afterwards are new machines used only for operations, a precaution rather than a replacement of damaged ones[1]. This stage is marked Not in path, and the flow on the map passes through it without touching any IT technique.

OT targeting: a direct compromise

The control system itself was reached and operated. Every change the attacker made, to the pump pressure and to the pumps’ ability to restart, was made on the SRO system that runs the waterworks[1][7]. That makes this a direct OT compromise. Nothing stood between the setpoint and the pipe: no source describes a pressure relief, an interlock or an alarm that limited the pressure.

OT sophistication: crude

The attack needed an exposed remote-desktop session, a four-digit PIN and the operator screen[1]. No source describes malware, or any knowledge of industrial protocols beyond the human-machine interface. The US advisory warns that these groups “regularly make false or exaggerated claims about their attacks on critical infrastructure”[8]; here the physical effect comes from the victim’s own account, not from the group’s.

OT impact: pumps set to zero, then to full pressure, then locked

The operator’s account confirms each step. The pressure on all pumps was set to manual at zero percent, then to 100 percent: Modify Parameter and Manipulation of Control in MITRE ATT&CK for ICS terms, shown on the map as Manipulate Control[1]. The pumps were locked so that on the second day they could be restarted neither remotely nor on site; that is Denial of Control, shown as Loss / Denial of Control[1]. The alarm on the second day reported the pressure problem after the fact, and the first event was noticed through the loss of supply[1].

Perils: a pipe burst by over-pressure

The primary peril is pressure failure: with the pumps at 100 percent, the raised pressure burst a water pipe[1][7]. Water then escaped through one large and one smaller break, and a further leak was found later; Euronews says “at least three pipes” burst, which agrees if the later leak is counted[1][6]. That is loss of containment, a secondary peril. The households’ loss of supply is the consequence for those who depend on the works. No source reports flooding of property, contamination, fire or injury.

Setting the pumps to 100 percent from the operator screen was enough to burst a pipe.

Financial losses: what it cost

The waterworks disclosed one figure: repairs, leak tracing and new security equipment cost “several hundred thousand kroner”, with no exact amount and no breakdown[1]. The money had been earmarked for groundwater-protection compensation. The works had no cyber insurance, and no property claim for the pipe breaks is mentioned[1]. Because the figure has no number, it is not listed as an amount below.

Loss evidence

Confirmed: Pipe breaks (first-party property damage); Cyber-physical event response (site visit, vendor restoration, pipe repair); Halted water delivery (direct business interruption); Third-party physical and societal impact (households without water); Network event response and recovery; Voluntary improvements (VPN, work-only computers, new security equipment)
Implied: Startup and return-to-service validation
Not supported: Equipment repair and replacement; Manual operations and workarounds; Legally mandated improvements; Cyber insurance (no policy); Cyber-physical cover response; Computer and laptop replacement; Embedded device replacement; Industry regulation liability; Public relations response

“My advice to other companies is not to cut costs on cybersecurity and to take out cyber insurance,” the chairman said a year later[6]. The Danish Environmental Protection Agency’s letter to all water suppliers and the NIS2 rules for the roughly 100 largest waterworks were sector-wide measures, not orders to this works[7], which won the Openness Prize at the Cyber Security Awards 2025 for its account of the attack[10].

What this incident shows

A cheaper remote-access arrangement turned a village waterworks’ operator screen into an internet service guarded by a four-digit PIN[1]. The fix was a VPN. “In hindsight, it is the biggest mistake we have made,” the chairman said[1].

The second lesson is about severity. Nothing independent of the operator setpoint limited the pressure, so changing a value on the screen was enough to break pipes[1][7]. Once the screen was reached, only an engineered limit on pressure could have stopped the damage, and there was none. The harm was small and local, but the path from a password to a burst pipe was short.

References

Kingod, Mette. “Vandværk hacket: Fjernadgang var ikke sikret godt nok [Waterworks hacked: remote access was not secured well enough].” Danske Vandværker, 24 Jan. 2025 (updated 19 Dec. 2025). danskevv.dk/nyheder/vandvaerk-hacket-fjernadgang-var-ikke-sikret-godt-nok/
Burrows, Emma. “Denmark Blames Russia for Cyberattacks on Utility That Left Houses Without Water.” Associated Press, 22 Dec. 2025, as carried by Insurance Journal. insurancejournal.com/news/international/2025/12/22/851915.htm
Forsvarets Efterretningstjeneste (Danish Defence Intelligence Service). “Russia is responsible for destructive and disruptive cyber-attacks against Denmark.” 18 Dec. 2025. fe-ddis.dk/globalassets/fe/dokumenter/2025/-russia-responsible-for-cyber-attacks-.pdf
Gallagher, Ryan. “Hackers Sympathetic to Russia Turn Cyberattacks Into a Physical Threat.” Bloomberg Businessweek, 27 Oct. 2026, as relayed by Meduza, 28 Oct. 2026. meduza.io/en/feature/2026/10/28/russia-linked-hackers-are-exploiting-poorly-secured-industrial-systems-to-sabotage-factories-utilities-and-food-production-across-the-west-bloomberg-reports
“Tureby-Alkestrup deler erfaringer på ministerbesøg [Tureby-Alkestrup shares its experience on a ministerial visit].” Danske Vandværker, 24 Nov. 2025. danskevv.dk/nyheder/tureby-alkestrup-deler-erfaringer-paa-ministerbesoeg/
“Denmark blames Russia for cyberattacks on water utility and election websites.” Euronews, 19 Dec. 2025. euronews.com/2025/12/19/denmark-blames-russia-for-cyberattacks-on-water-utility-and-election-websites
“Russiske hackere angreb dansk vandværk: nu strammer myndighederne kravene [Russian hackers attacked a Danish waterworks: now the authorities tighten the requirements].” TV 2 Kosmopol, 2025. tv2kosmopol.dk/koege/russiske-hackere-angreb-dansk-vandvaerk-nu-strammer-myndighederne-kravene-cad31
FBI, CISA, NSA and partners. “Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure.” Joint Cybersecurity Advisory AA25-343A, 9 Dec. 2025. ic3.gov/CSA/2025/251209.pdf
U.S. Attorney’s Office, Central District of California. “Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups.” Release 25-272, 9 Dec. 2025. justice.gov/usao-cdca/pr/justice-department-announces-actions-combat-two-russian-state-sponsored-cyber-criminal
“Lokalt vandværk vinder pris efter hackerangreb [Local waterworks wins prize after hacker attack].” Dagbladet (sn.dk), 15 Mar. 2025. dagbladet.sn.dk/article/6264163/koege-kommune/nyhed/lokalt-vandvaerk-vinder-pris-efter-hackerangreb