Denmark Archives - ICSSTRIVE

Novo Nordisk Suffers Second Ransomware Attack

June 5, 2026

Danish pharmaceutical giant Novo Nordisk, the maker of popular weight loss drug Wegovy, disclosed two ransomware incidents where the threat actors were seeking $25 million in one attack, and $50 million in the other.
In the second attack “TheUSERS007,” said they were going to leak stolen data after ransom negotiations with Novo Nordisk failed.
Those threat actors claim to have acquired between June 5-7 some different data than what FulcrumSec shared in the first attack. Both threat groups appeared to have been negotiating with Novo Nordisk at the same time.
Data incident site, DataBreaches, asked TheUSERS007 how they gained access to Novo Nordisk and the answer is frightening. In a chat on Tox, a spokesperson for TheUSERS007 told DataBreaches they used venomware.
Venomware is an emerging, highly advanced class of digital attack tool classified as a self-learning, adaptive AI engine used to surgically extract intellectual property. Unlike traditional malware, it does not typically break into systems using forced exploits or encryption; rather, it uses artificial intelligence to identify misconfigurations and navigate networks. which they describe as a self-learning, adaptive AI engine designed for the surgical extraction of intellectual property.

Pharmaceutical Maker Novo Nordisk Suffers Ransomware Attack

March 10, 2026

Despite a cyberattack at Novo Nordisk A/S that forced the company to shut down some systems, its core business operations remain up and running.
To that end, Novo Nordisk, the maker of weight-loss drug Wegovy, said Thursday, June 11, it identified an IT security incident involving unauthorized access to a limited number of internal IT systems.
“Upon learning of the incident, we launched an investigation with the assistance of external cybersecurity experts, and we are in contact with the relevant authorities,” the company said in an advisory.

Arla Foods’ Production Disrupted in Germany

May 19, 2025

Danish food giant Arla Foods confirmed a cyberattack disrupted its production operations. The attack affected its production unit in Upahl, Germany, and resulted in product delivery delays and cancellations. “We can confirm that we have identified suspicious activity at our dairy site in Upahl that impacted the local IT network,” stated an Arla spokesperson. “Due to the safety measures initiated as a result of the incident, production was temporarily affected.” Production at other Arla sites is not affected. Arla Foods publicly confirmed the cyberattack on 19 May 2025

SAS Scandinavian Airlines’ App Compromised by a Cyberattack

February 14, 2024

SAS Scandinavian Airlines was hit by a cyber attack on February 14th, compromising its app. The airline was said to be working on a solution, with reports saying that the problem was fixed to a large extent. Still, SAS warned that the attack may have targeted customer data following the breach.

DDoS Attack Disrupts Copenhagen Airport

February 25, 2024

The Copenhagen airport experienced a significant cyberattack on a Sunday, causing widespread chaos as Denmark’s largest airport grappled with the aftermath. Identified as a denial of service (DoS) attack, the attack targeted the airport’s digital infrastructure, rendering its official website inoperative and leaving passengers and officials struggling for alternatives.

Airport authorities redirected passengers to a smartphone app for flight updates, highlighting the vulnerability of critical systems and the disruptive potential of cyber threats.

Largest Recorded Cyberattacks at Danish Energy Infrastructure

May 11, 2023

This past May, Danish critical infrastructure suffered the most extensive cyber-related attack it ever experienced in Denmark to date. In all, 22 companies that operate parts of the Danish energy infrastructure ended up compromised in a coordinated attack, according to a report by SektorCERT. The result was the attackers gained access to some of the companies’ industrial control systems and several companies had to go into island mode operation.

The attacks began on May 11, followed by 10 days of inactivity. A second wave of attacks began on May 22 when SektorCERT received an alert that one of its members had downloaded new firewall software over an insecure connection. Whether the attack came from servers associated with a unit of Russian military hackers popularly known as Sandworm cannot be said with certainty. Individual indicators of this have been observed, but we have no opportunity to neither confirm nor deny it, states the SektorCERT report.

Paralyzing Cyberattack Hits Danish Cloud Service Companies

August 18, 2023

CloudNordic has told customers to consider all of their data lost following a ransomware infection that encrypted the large Danish cloud provider’s servers and “paralyzed CloudNordic completely,” according to the IT outfit’s online confession. The hackers shut down all of CloudNordic’s systems, wiping both company and customers’ websites and email systems, even the backups and production data were trashed. CloudNordic isn’t prepared, nor able, to pay a ransom, presumably to restore the information and systems. CloudNordic says its “best estimate” is that the infection happened as servers were being moved from one datacenter to another.

Customers with Azero are also affected. CloudNordic and Azero are owned by Denmark-registered Certiqa Holding, which also owns Netquest, a provider of threat intelligence for telcos and governments.

Trains Stop for Danish Train Operator DSB

October 29, 2022

A breakdown of Denmark’s train network last weekend was the result of a hacker attack on an IT subcontractor’s software testing environment, Danish train operator DSB said.
“We were contacted by our subcontractor who told us that their testing environment had been compromised by criminal hackers,” DSB’s chief of security, Carsten Dam Sonderbo-Jacobsen, told public broadcaster DR.
“It hasn’t targeted infrastructure or DSB, it was economic crime,” Sonderbo-Jacobsen said in a Reuters report, adding it was not clear who was behind the attack, but that investigations were ongoing.

Wind Turbine Maker Hit in Cyber Attack

November 19, 2021

One of the world’s biggest wind turbine makers, Aarhus, Denmark-based Vestas Wind Systems A/S, shut down computer systems across several locations Saturday to deal with a cyber security incident.
Vestas discovered a cyber security incident Friday and has since then, together with external partners, worked to contain the situation and re-establish the integrity of its IT systems.
The company’s preliminary findings indicate the incident had an impact on parts of Vestas’ internal IT infrastructure and data has suffered compromise.