Just before Christmas, hackers attacked a small waterworks and burst the pipes: "It stands as a nightmare for me"

Last year just before Christmas, Jan Hansen was awakened by a shock.

A hacker attack took control of the small waterworks Tureby-Alkestrup south of Køge and turned on and off the pressure in the pumps.

The attack caused three water pipes to burst throughout the town up until Christmas Eve.

- It stands as a nightmare for me, says board chairman Jan Hansen.

And it has taught him an important lesson.

- One must take cybersecurity seriously, and no one is too small to be targeted. It is our little work a clear example of, he says.

Earlier today, the Security and Intelligence Service concluded at a press conference that Russia is currently conducting a hybrid war against Denmark.

- It is our assessment that Russia is currently conducting a hybrid war against Denmark and the West, said FE-chief Thomas Ahrenkiel.

Previously in 2024, pro-Russian hackers broke into an unnamed waterworks and burst several water pipes.

Danish waterworks are daily subjected to attempts at hacker attacks, and according to Danva - interest organization for drinking water and sewage companies - water supply companies are collectively exposed to about 6,000 attempts per hour.

This has led Danva, KL and several waterworks to request clear guidelines from the authorities, which can dictate how waterworks should prepare for hybrid attacks.

The incident in Køge sets two examples, that it sometimes succeeds for hackers to penetrate waterworks.

Here the small waterworks serves as an example of why it is important to have a strong IT system that can keep hackers out. Jan Hansen acknowledges this fully, admitting that they were not well prepared for what was to come.

According to Jan Hansen, the waterworks itself had cut back and reduced on security, and it has previously been reported that the waterworks' codeword for the IT system was "1234" (https://jyllands-posten.dk/indland/ECE17839480/koden-var-1234-for-foerste-gang-er-dansk-vandforsyning-blevet-angrebet-af-prorussiske-hackere ).

- We chose to sacrifice security from. Both because it was easier and cheaper, he says and continues:

- And we obviously did not believe that we would be exposed to attacks. A small waterworks with 448 shareholders. But we were, and it cost a lot.

According to Jan Hansen, the Security and Intelligence Service later passed by the waterworks and took the waterworks' IT equipment.

--------------------

Emergency Supply Line

--------------------

On the other side of the country, Dronningborg Waterworks in Randers has taken advantage of the situation and tried to take an extra step that can help strengthen their supply security in the future.

Here the waterworks, which supplies water to about 2,000 households, has just connected an emergency supply line, which will ensure them running water, if the flow disappears, or the water is contaminated.

So far the facility has been closed to the public, alarms have been set up, and the place has no internet.

Board chairman Berit Pedersen informs that they do not experience hybrid attacks, but that they are very vigilant.

According to board chairman Berit Pedersen, Dronningborg Waterworks takes the risk of hybrid threats very seriously.

- It is a very heavy and serious responsibility that we take seriously. Now we can ensure in case of power failure or bacterial contamination, but it will not solve, if we have a technical breakdown or damage to the water pipes.

Therefore, they have connected the emergency supply line to the water supply company Verdo, which is located a few kilometers from Dronningborg Waterworks.

- We think that our consumers can feel an extra security in case of larger contamination incidents or deliberate power outages in our area, she says.

---------------------

New legislative proposal on the way

---------------------

In the wake of the incident, Jan Hansen and waterworks Tureby-Alkestrup - with professional help - have upgraded on security.

He is therefore not worried that something similar will happen again. But hybrid attacks can look in many ways, which can hit waterworks like his.

- So I am worried that they will find something new, which we have not thought of, he says.

But both he and Berit Pedersen from Randers demand clear guidelines from the authorities, which can help them and other waterworks prepare adequately for hybrid attacks.

Read also: Naughty and clumsy: Experts and spokespersons are longing for Denmark's drone defense (https://www.dr.dk/nyheder/indland/noelende-og-fodslaebende-eksperter-og-ordfoerere-langer-ud-efter-danmarks-droneberedskab )

On Tuesday, when the Folketing opens, environmental minister Magnus Heunicke (S) will present a new legislative proposal, which will set a national direction for the country's waterworks regardless of size.

The proposal will include requirements for waterworks' emergency plans. Both when it comes to physical security, monitoring and cybersecurity.

- Due to the threat that we unfortunately can see, we are forced to change the legislation and take more central action with some concrete, central requirements that will apply to all waterworks, says the minister.

Warning: This article was translated by a Large Language Model, in case of doubt, you can always visit the original source.