In May 2023 attackers took the firewalls guarding 22 Danish energy companies, some with a single packet. No loss of power or heat is on the record. Operators cut the internet and kept running. One crew ran three sites by hand.
SektorCERT’s report does something almost no document in this book does. It splits itself in two: a timeline labelled objective, and an analysis labelled subjective, with the sentence “we may be wrong in our assessments.” The headlines kept the analysis and dropped the label. What was observed is that Zyxel firewalls at 22 energy companies were compromised. The state actor is analysis, and SektorCERT’s own conclusion is that there is no evidence to accuse Russia.
What did not fall was the process. Members cut the internet and went into island operation, one for six days. That is fallback capacity doing its job. The uncomfortable detail is at one member whose firewall also routed traffic inside the production network: when the gate failed, it lost its view of three remote sites and a crew drove out to run them by hand. That this gate-that-is-also-the-router pattern is common at small operators is BlastWave’s analysis, not a disclosed fact.
What is not known: How the first-wave attacker knew which of about 300 members had a vulnerable firewall is unexplained, and SektorCERT says so. Who attacked is unresolved: two single packets went to servers linked to Sandworm, yet SektorCERT found no evidence to accuse Russia, and Forescout argues the second wave was unrelated botnet activity. Whether the second wave used flaws Zyxel had not yet disclosed is disputed. The police cyber unit’s malware analysis is unpublished, and no member has disclosed a cost.
Recommendation
Take the path away from the gate The device guarding a control network should answer nothing unsolicited from the internet. Here one packet to the firewall’s own VPN service was enough.
Take away the gate’s standing authority Owning the perimeter device must not mean owning the plant. Control access needs its own identity check, and the firewall is never also the internal router.
Make remote monitoring read one way Remote-site visibility leaves one way, so island operation costs the view and never control. Rehearse the switch to island operation before you need it.
Sources: SektorCERT, The attack against Danish critical infrastructure, TLP:CLEAR, Nov 2023; Forescout Vedere Labs, Clearing the Fog of War, 11 Jan 2024; Zyxel advisories, 25 Apr and 24 May 2023; CISA KEV listing. Full list with links.
Soft Spots: Attacker unknown: the Sandworm-linked packets are indicators only. SektorCERT’s ICS-access sentence runs only with its partner, “discovered and stopped.” That gate-as-router is common is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
In May 2023 attackers took the firewalls guarding 22 Danish energy companies, some with a single packet, and the operators cut the internet and kept running. What is verified, what is only reported, and what is still unknown.
Summary
In May 2023, attackers compromised Zyxel firewalls at 22 Danish energy companies in two waves, the first through a one-packet flaw, according to SektorCERT, the sector's own security center. Operators cut internet links and kept running; no loss of power or heat is on the record. Who attacked is unresolved: SektorCERT found no evidence to accuse Russia.1
Timeline of the Danish energy sector firewall attacks
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Zyxel announces a critical flaw in its firewalls, CVE-2023-28771: one crafted packet to the VPN service on UDP port 500 runs commands as root, with no username or password.1,3
SektorCERT issues an extraordinary warning to its members about the flaw.1
First wave: 16 energy companies are attacked at the same time and 11 are compromised. The attackers retrieve each firewall's configuration and usernames. SektorCERT, with no night staffing, works through the afternoon, evening and night, and all 11 are secured.1
Second wave detected. A member's firewall downloads new software and begins behaving as part of the Mirai botnet, joining denial of service attacks on targets in the US and Hong Kong. Just before 15:00, on SektorCERT's advice, the member cuts its internet connection completely and goes into island operation.1
Zyxel announces two further vulnerabilities, CVE-2023-33009 and CVE-2023-33010. SektorCERT's assessment is that the attackers possibly knew about them before the announcement.1,4
A member's firewall sends a single 1,340-byte packet to an address SektorCERT says it "had reliable information" belonged to Sandworm. No reply is returned. SektorCERT treats this as an indicator, not attribution.1
A single packet goes from another member to "another suspected Sandworm server." That member's firewall later goes completely down: it loses all visibility to three remote locations, its internal production network traffic stops, and staff drive out to operate the sites manually. The report's timeline dates this "24/5 at 01:22."1
A member orders a new firewall and runs in island operation for six days. The report does not say this is the same member that lost its view of three remote sites.1
CISA places the Zyxel vulnerabilities on its Known Exploited Vulnerabilities list, as recorded in SektorCERT's timeline.1,5
SektorCERT publishes "The attack against Danish critical infrastructure." Coverage from 13 to 16 November 2023 runs headlines linking Sandworm and describes island mode as going off the grid, which the report does not say.1,6,7,8,9
Forescout Vedere Labs publishes an analysis arguing the two waves were unrelated and the second was "part of a larger campaign of indiscriminate botnet exploitation."2,10
Denmark's Defence Intelligence Service attributes a 2024 attack on a Danish water utility to Russia-linked groups, as reported by BleepingComputer. That is a different incident, sector and year; the attribution does not cover the 2023 energy sector attacks.11
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
No member has disclosed a cost; no member is named
Undisclosed
How did attackers get into the Danish energy companies' firewalls?
Through a flaw in the Zyxel firewalls' own VPN service that one crafted packet could exploit, with no username or password. Zyxel announced CVE-2023-28771 on 25 April 2023. SektorCERT describes it as a single specially crafted packet to UDP port 500 that let an attacker run commands as root, and it issued an extraordinary warning to its members on 1 May.1,3 On 11 May, 16 member companies were attacked at the same time and 11 were compromised. One command handed the attacker each firewall's configuration and current usernames.1
SektorCERT's own words about the devices explain why that mattered: they "were often all that stood between the attackers and the control of Danish critical infrastructure."1
How the first-wave attackers knew exactly which members had a vulnerable firewall is not explained. SektorCERT writes that among its 300 members "they did not miss a single shot," and that there is still no clear explanation of how.1 Once exploit code was public, SektorCERT saw around 200,000 attack attempts a day against CVE-2023-28771.1
Why the firewalls were unpatched is, in SektorCERT's account, structural rather than careless. Some members believed a new device would be up to date, some assumed the supplier handled updates, some faced a supplier charge to install an update that was itself free, and some did not know they had the devices at all.1
Did the attackers reach Denmark's power system, and did anyone lose power or heat?
No loss of power or heat is on the record, and no command to a process device is described. SektorCERT's executive summary says the attackers "gained access to some of the companies' industrial control systems." Its analysis of the first wave adds the sentence that has to travel with it: "before they could exploit access to the critical infrastructure, they were discovered and stopped."1 As the record describes it, what the attackers held was the firewall in front of the control systems.
SektorCERT says that after the first wave the Danes still had electricity and heat, and it says nothing to the contrary about the second. Its conclusion is that the attacks had "minimal consequences for the critical infrastructure."1 That is why this page says no loss of power or heat is on the record, rather than that no customer was affected.
One member's consequence went further. Its firewall also functioned as the internal router for the OT network, so when it went completely down after the 01:22 event, the member lost all visibility to three remote locations and "all internal traffic in the production network also stopped working." Staff drove out and ran the sites manually. The operations manager is quoted: "It's good weather to drive in."1 The report does not say whether the attacker intended the failure.
What does "island mode" mean in the Danish energy attacks?
Island operation meant cutting the internet connection and running without it, not disconnecting from the electric grid. In SektorCERT's English report, every operational use of "island" is tied to the internet connection, and the word "grid" does not appear.1
"the member closed, just before 15, their internet connection completely and went into island operation"
Several members went into island operation during the second wave. One ran that way for six days while a new firewall was ordered; SektorCERT's conclusion notes that operating like that for so long takes good emergency procedures.1 The report does not identify the six-day member with the member that lost its view of three remote sites.
The Record wrote on 15 November 2023 that the companies had to "disconnect from the main electric grid," and Cybernews glossed island mode as "off-grid." The report does not say that.7,8
Did Russia or Sandworm attack Denmark's energy sector in 2023?
That is not established. SektorCERT, which handled the incident, found no evidence to accuse Russia,1 and no government has attributed this incident, as of late September 2026. The report's executive summary says there are "indications that a state actor may have been involved" in one or more attacks. The indicators are two single network packets, each of 1,340 bytes, sent on 24 May at 19:02 and on 25 May at 01:22 to two addresses SektorCERT linked to Sandworm. Neither received a reply. The report calls the first "One ping only."1
"Whether Sandworm was involved in the attack cannot be said with certainty. Individual indicators of this have been observed, but we have no opportunity to neither confirm nor deny it."
"There is therefore no evidence to accuse Russia of being involved in the attack."
SektorCERT leans toward two different attack groups rather than one.1Headlines in November 2023 carried the Sandworm link without the hedge; Infosecurity Magazine's article body quotes SektorCERT's caution under a headline that does not. The Register summarized the finding in its own words, that attribution "could not be made with confidence due to the overall lack of evidence"; that sentence is the reporter's, not SektorCERT's, and it does not appear in the report.1,6,9
Denmark's December 2025 attribution is about a different incident.BleepingComputer reported on 19 December 2025 that the Danish Defence Intelligence Service attributed a 2024 attack on a Danish water utility to Z-Pentest and NoName057(16). That is a different sector and a different year, and its attribution does not carry over to the 2023 energy sector attacks.11
Were the two waves of attacks the same campaign?
That is disputed, and this page does not choose between the readings. SektorCERT reads the first wave on 11 May as targeted and leans toward the second wave, from 22 May, being a second attack group. It assesses that the second wave "possibly" used CVE-2023-33009 and CVE-2023-33010 before Zyxel announced them on 24 May.1,4
"Our evidence suggests that the two waves of attacks on Danish infrastructure reported by SektorCERT ... were unrelated"
Forescout calls the first wave "a potentially targeted attack" and argues the second was "part of a larger campaign of indiscriminate botnet exploitation," using CVE-2023-28771 rather than the newer flaws.2,10 Nobody has reconciled the two readings in any source this entry relies on.
How was the Danish energy attack detected and contained?
SektorCERT's sensor network saw the coordinated first wave on 11 May 2023, and SektorCERT secured all 11 compromised companies overnight, without a night shift. SektorCERT had about 300 members and 270 sensors at the time. It says it had no staffing for night work and kept working through the afternoon, evening and night until each of the 11 was secured.1
In the second wave, members cut their internet connections, the first of them on SektorCERT's advice, and kept operating. One member's staff drove out and ran three remote sites by hand. SektorCERT's account of why firewalls went unpatched points to supplier agreements, supplier charges and devices nobody knew were there.1
The report is also unusual in how it is written. It labels its timeline objective, limited to what was directly observed, and labels its analysis subjective:
"This part of the report is subjective and we may be wrong in our assessments."
The state actor, the Sandworm-linked packets and the two attack groups all sit in the labeled analysis. What was observed is that Zyxel firewalls at 22 energy companies were compromised.1
What is still not known about Danish Energy Sector
How the first-wave attacker knew exactly which of about 300 members had a vulnerable firewall. SektorCERT says there is no clear explanation.1
Who attacked. Two single packets went to addresses SektorCERT linked to Sandworm, yet it found no evidence to accuse Russia, and Forescout argues the second wave was unrelated botnet activity.1,2
Whether the second wave used flaws Zyxel had not yet disclosed. SektorCERT says "possibly"; Forescout points to CVE-2023-28771.1,2
Whether the firewall failure that cut one member off from three remote sites was intended. The report does not say.1
What payloads, if any, were involved in the two Sandworm-linked events.
The results of the Danish police cyber unit's in-depth analysis of the collected malware. SektorCERT says it began; no publication was found as of late September 2026.1
Which companies were affected, and what the incident cost any of them. No member is named and none has disclosed a cost.
Claims about Danish Energy Sector the record does not support
Widely repeated claim
What the record says
In island mode the companies "had to disconnect from the main electric grid."
Island operation meant cutting the internet connection. The word "grid" does not appear in SektorCERT's English report; every operational use of "island" is tied to the internet connection.1,7,8
"Russian Hacking Group Sandworm Linked to Unprecedented Attack on Danish Critical Infrastructure." (Infosecurity Magazine headline)
SektorCERT found "no evidence to accuse Russia." The indicators are two single packets to addresses it linked to Sandworm, and no government has attributed this incident, as of late September 2026.1,9
"More than 100,000 people" were in the worst-case path.
Carried by Cybernews; the figure is not found in SektorCERT's report.1,8
BlastWave analysis: the perimeter fell, the process did not
Analysis, not a disclosed fact
The argument this incident supports is perimeter versus process. SektorCERT says those firewalls were often all that stood between the attackers and control of Danish critical infrastructure, and one crafted packet could take one. What did not fall was the process. Members cut the internet and went into island operation, one of them for six days. That is fallback capacity doing its job, and it places the entry on the rung of OT-adjacent access and capability development, at the perimeter, with no process consequence on the record. The operators acted well. So did SektorCERT, which had no night shift and worked through the night anyway.1
The uncomfortable detail is at one member. Its firewall also routed traffic inside the production network, so when the gate failed, the plant lost its own internal traffic and its view of three remote sites, and a crew drove out to run them by hand. For that member the entry touches the next rung up: loss of supervisory control with the process continuing.1 That this gate-that-is-also-the-router pattern is common at small operators is BlastWave's analysis, not a disclosed fact.
Podcast: “The Gatehouse” (8:49). Joe Baxter and Cam Cullen on why the perimeter fell at 22 companies and the process did not.
Video: Danish Energy Sector Short (60 to 90 seconds).
Frequently asked questions
What happened in the 2023 Danish energy sector cyberattack?
Between 11 and 25 May 2023, attackers compromised the Zyxel firewalls of 22 Danish energy companies, according to SektorCERT's November 2023 report. On 11 May, 16 companies were attacked at once and 11 were compromised through a flaw exploitable with one crafted packet. A second wave from 22 May enrolled firewalls in Mirai botnets. Operators cut their internet connections and kept running, and no loss of power or heat is on the record.
Did Russia or Sandworm attack Denmark's energy sector?
That is not established. SektorCERT recorded two single packets sent to addresses it linked to Sandworm, but wrote that whether Sandworm was involved cannot be said with certainty and that there is no evidence to accuse Russia. Forescout argued in January 2024 that the second wave was unrelated botnet activity. As of late September 2026, no government has attributed this incident.
Did anyone in Denmark lose power or heat?
No loss of power or heat is on the record. SektorCERT's November 2023 report says the Danes still had electricity and heat after the first wave, describes no supply loss in the second, and concludes the attacks had minimal consequences for the critical infrastructure. One member lost its view of three remote sites and ran them manually, but the process kept going.
What does island mode mean in the Danish energy attacks?
In SektorCERT's report, island operation means a company cut its internet connection completely and kept operating without it. It does not mean disconnecting from the electric grid, and the word grid does not appear in the English report. One member ran in island operation for six days in May 2023 while a new firewall was ordered.
How did the attackers get into the Danish energy companies?
Through CVE-2023-28771, a Zyxel firewall flaw announced on 25 April 2023. SektorCERT says one specially crafted packet to UDP port 500 let an attacker run commands as root without a username or password. The vector for the second wave is disputed: SektorCERT says possibly two newer flaws, while Forescout says it observed CVE-2023-28771.
Is this the same as the Danish water utility attack Denmark blamed on Russia?
No. In December 2025, BleepingComputer reported that Denmark's Defence Intelligence Service attributed a 2024 attack on a Danish water utility to Russia-linked groups. That is a different incident, sector and year. The May 2023 energy sector firewall attacks described by SektorCERT have no government attribution, as of late September 2026.
Were the two waves of the Danish attacks carried out by the same group?
That is disputed. SektorCERT, in the labeled analysis section of its November 2023 report, leans toward two different attack groups. Forescout Vedere Labs argued on 11 January 2024 that the waves were unrelated and that the second was part of a larger campaign of indiscriminate botnet exploitation. Neither reading has been settled.
The primary source is SektorCERT's own November 2023 report, with the vendor's security advisories and a named researcher's published analysis. Press is cited only as evidence of what was said.
CompanySektorCERT, "The attack against Danish critical infrastructure," TLP:CLEAR, November 2023, English edition. SektorCERT is the non-profit security center owned and funded by Danish critical infrastructure companies. The report separates an objective timeline of what was observed from a subjective analysis.
ResearcherForescout Vedere Labs (Jos Wetzels), "Clearing the Fog of War: A critical analysis of recent energy sector cyberattacks in Denmark and Ukraine," blog, 11 January 2024. The full report behind the blog was not read for this entry. forescout.com
CompanyZyxel, security advisory for CVE-2023-28771, 25 April 2023. Date as recorded in SektorCERT's timeline. zyxel.com
CompanyZyxel, security advisory for CVE-2023-33009 and CVE-2023-33010, 24 May 2023. Date as recorded in SektorCERT's timeline. zyxel.com
FederalCybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, listing of the Zyxel vulnerabilities, recorded in SektorCERT's timeline under 30 May 2023.
PressThe Register (Connor Jones), "Inside Denmark's hell week as critical infrastructure orgs faced cyberattacks," 13 November 2023. Cited as evidence of what was said, including its own paraphrase of SektorCERT's attribution finding. theregister.com
PressThe Record (Daryna Antoniuk), "Nearly two dozen Danish energy companies hacked through firewall bug in May," 15 November 2023. Cited as evidence of what was said, including island mode described as disconnecting "from the main electric grid." therecord.media
PressCybernews, "Denmark hit with largest cyberattack on record," 14 November 2023. Cited as evidence of what was said, including island mode glossed as "off-grid" and a "more than 100,000 people" worst-case figure. cybernews.com
PressInfosecurity Magazine (James Coker), "Russian Hacking Group Sandworm Linked to Unprecedented Attack on Danish Critical Infrastructure," 16 November 2023. Cited as evidence of what was said; the article body quotes SektorCERT's hedge under a headline that does not carry it. infosecurity-magazine.com
PressCyberScoop, "Sandworm probably wasn't behind Danish critical infrastructure cyberattack, report says," January 2024, reporting Forescout's analysis (Daniel dos Santos, Forescout). Cited as evidence of what was said. cyberscoop.com
PressBleepingComputer, "Denmark blames Russia for destructive cyberattack on water utility," 19 December 2025. Cited only to distinguish it: a 2024 incident at a Danish water utility, attributed by the Danish Defence Intelligence Service to Z-Pentest and NoName057(16). Not this incident. bleepingcomputer.com
Cite this page
BlastWave. “Danish Energy Sector Zyxel Firewall Attacks (2023): What Is Verified.” Hackopedia, Volume 2, FILE 031. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/danish-energy-sector-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 031 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Consistency re-check. The scale is stated as SektorCERT counts it, 22 companies compromised through their firewalls, and island operation is described as the report describes it. The statement that no government has attributed this incident was re-examined; it is dated, because no single document can confirm an absence.
26 Sep 2026
Full validation. SektorCERT's English report was retrieved again from SektorCERT's site and every quotation matched against it, including both attribution sentences with their original grammar. Confirmed that "grid" appears nowhere in the report and that every operational use of island operation refers to the internet connection. Supply wording tightened to what the report supports: no loss of power or heat is on the record. Confirmed that the report does not identify the member that ran six days in island operation with the member that lost its view of three remote sites.
24 Sep 2026
Volume 2 entry built from primary sources: SektorCERT's November 2023 report, read in full, and Forescout's January 2024 analysis.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
