Denmark raises cyber threat level as Russia’s hybrid pressure builds
Denmark has raised its destructive-cyber threat level to high, judging Russian disruptive attacks “likely” as Moscow’s hybrid pressure on NATO intensifies.
Key facts
- Denmark raised the threat level for destructive cyberattacks from medium to high, citing a “likely” Russian attempt.
- Danish Defence Intelligence warns Russia will intensify hybrid warfare against the West and NATO with greater consequences.
- Authorities highlight wiper attacks and OT manipulation; a 2024 pro-Russian attack disrupted water supply to 450 homes.
3 minute read
Denmark has elevated its national assessment of destructive cyber risk from “medium” to “high”, with the Danish cyber agency judging it “likely” that Russia will attempt destructive cyberattacks. The decision is presented alongside a broader intelligence warning that Moscow will intensify hybrid operations against the West and NATO in the coming months, with more frequent actions and greater consequences for targeted states.
The Danish Defence Intelligence Service’s threat assessment further assesses a low but rising risk of a limited military attack against one or more NATO countries on Russia’s borders, underscoring that cyber disruption, sabotage, and military signalling are being considered in a single escalation spectrum. The Danish Police Intelligence Service has reportedly identified specific Russian planning and preparation of sabotage aimed at Denmark, with authorities judging that Russia is accepting greater operational risk.
From a European procurement and readiness perspective, Denmark’s public move is significant less for its nomenclature than for its timing: Copenhagen appears to be the first EU country to formally raise and announce a higher destructive-cyber threat level in response to the recent acceleration in Russian hybrid activity. This creates pressure for peer governments to clarify their own thresholds and to align incident-response authorities across defence, interior, and sectoral regulators, particularly where civilian critical infrastructure underpins military mobility and host-nation support.
Danish authorities explicitly highlight “wiper” malware designed to destroy data and attacks that manipulate operational technology to change real-world outputs. That emphasis reflects a shift from espionage-dominant cyber risk to effects-based disruption, with potentially immediate implications for defence-adjacent services such as water, power, transport logistics, and communications. Denmark cites a 2024 incident in which pro-Russian hackers with Kremlin ties attacked a small waterworks, briefly disrupting supply to around 450 households, as a concrete illustration of how relatively modest OT targets can generate outsized political and social impact.
For European stakeholders, the Denmark warning should be read as a prompt to stress-test continuity plans for OT-heavy utilities, tighten supply-chain assurance for industrial control components, and refine cross-border coordination for attribution and response—particularly as Russian hybrid activity is reported to be widening across Europe.
Source: Politico Europe
