Denmark Under Siege: Cyberattacks Hit Hospitals, Cities

Edward Walgwe

December 2, 2025
4:14 pm

Public institutions in Denmark have faced a wave of cyberattacks in recent weeks, with hospitals and municipalities across the country blocking hundreds of millions of attempts to break into their systems. Security experts warn that state-backed hackers from Russia, China, and North Korea are trying to weaken Western societies.

Massive cyber pressure on public systems

Government institutions in Denmark are under intense digital pressure. In just one month, municipalities in East Jutland and the Central Denmark Region collectively blocked more than 345 million attempted intrusions into their networks. Most of these attacks targeted hospitals and administrative systems, aiming to overload or disrupt key IT infrastructure.

In Randers, hackers attempted to bring down the city’s systems with a 24-hour distributed denial-of-service attack around the time of the local election. The municipality had been warned in advance and expanded its server capacity to mitigate the assault. As a result, most users only noticed that the city’s website was running slightly slower than usual.

These ongoing threats highlight how fragile even well-defended networks can be. Experts emphasize that this constant pressure makes it difficult for local governments to maintain routine digital operations while defending against such attacks.

Millions of malicious emails blocked

Region Midtjylland, which operates hospitals throughout Central Jutland, reported that it had stopped about 345 million attempted system contacts in November alone. Many of these were deliberate attack efforts. During the same month, roughly 22.5 million incoming emails were blocked because they contained phishing attempts or damaging software.

The Danish Emergency Management Agency recently updated its national threat assessment, describing the cyber risk level as very high. Meanwhile, security officials noted increasing activity by foreign actors targeting critical sectors such as health care, water, and energy.

This mirrors previous patterns, where cyber threats have affected essential utilities across Denmark. Similar issues have been reported at water systems that were attacked by foreign hackers, briefly disrupting local supplies.

Hackers target city governments

Municipalities across Jutland continue to deal with repeat break-in attempts. In Aarhus, the pro-Russian hacker group Noname057(16) launched a digital attack designed to shut down the city’s website before the election.

Favrskov’s head of IT, who also leads Denmark’s municipal IT directors’ association, explained that local governments receive constant warnings from the national cybersecurity center. It tracks hacker activity on the dark web, where groups publish lists of targeted cities. Even when attacks fail, the uncertainty forces municipalities to stay on alert at all times.

Real consequences for citizens

Experts stress that cyberattacks are no longer abstract threats. When hackers gain access to public systems, the direct impact can be severe. Previous incidents have shown how these attacks can cut power, disrupt energy supply, or even block access to patient records.

A recent case involved a Danish water facility near Køge, where a ransomware attack temporarily prevented hundreds of residents from getting clean water. Specialists warn that if hackers succeed in compromising IT systems at hospitals or emergency services, the consequences could affect life-saving care.

The complexity of these threats has also created immense pressure on IT departments already struggling with staff shortages. Danish municipalities are working with national intelligence agencies to strengthen cybersecurity and improve coordination across different levels of government.

Foreign influence and digital strategy

According to researchers at Aarhus University, the motivation behind these waves of cyber interference is not just to cause short-term damage. Instead, state-aligned groups from Russia, China, and North Korea are believed to target both small and large institutions as part of a long-term effort to destabilize Western democracies.

Their aim is to undermine trust, sow division, and weaken citizens’ confidence in the ability of their governments to maintain essential services. This strategy of digital disruption also serves as a way to retaliate against Western support for Ukraine and to demonstrate the reach of their influence.

For ordinary Danes, the message is clear: protecting the country’s digital foundations requires constant vigilance, from system administrators to individual users.