Water and energy under attack: December 2025, a dress rehearsal for physical damage

In December 2025 Denmark attributed to Russia an attack on a waterworks that had burst pipes, ransomware encrypted 1,000 systems at Romania's water authority and a destructive attack hit more than 30 energy plants in Poland. The analysis: physical damage, state-actor exclusions, aggregation and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, December 2025 · by cybercoverinsurance

In December 2025 three episodes showed, within a few weeks, what happens when attacks reach physical plants. On 18 December Denmark attributed to Russia a 2024 attack on a waterworks that had burst pipes and left homes without water. Late in the month ransomware encrypted about 1,000 systems at Romania's national water authority. On 29 December a destructive attack hit more than 30 wind and solar plants and a large combined heat and power plant in Poland.

For cyber underwriters the three cases are a test bench for three themes: physical damage caused by a cyber attack, state-actor exclusions and aggregation on critical infrastructure. None of the three caused serious damage, and that is exactly why they should be read as dress rehearsals.

What is known

Denmark, the waterworks. In late 2024 the pro-Russian group Z-Pentest altered water pressure at the Tureby Alkestrup waterworks in Køge, 35 km south of Copenhagen. At least three pipes burst, about 50 households were without water for seven hours and 450 for one hour. On 18 December 2025 the Danish Defence Intelligence Service attributed the attack to groups linked to the Russian state, Copenhagen's first public attribution of this kind. The head of the waterworks, Jan Hansen, advised other companies not to cut costs on cyber security and to take out cyber insurance (Euronews). The same service named the group NoName057(16) for overload attacks on Danish websites before the 2025 local elections (Security Affairs).

Romania, the water authority. In late December 2025 an attack compromised about 1,000 IT systems at the national authority Apele Române and at 10 of its 11 basin administrations. The attackers used BitLocker, the encryption tool built into Windows, rather than their own ransomware. Application servers, databases, email, websites and DNS were hit. According to the national cyber security directorate, the operational systems controlling water plants were not touched and water management continued (eSecurity Planet).

Poland, the energy grid. On 29 December 2025 an attacker hit more than 30 wind and solar plants at their grid connection points, a large combined heat and power plant supplying heat to almost half a million customers, and a manufacturing company. At the renewable sites remote controllers, protection relays and communication equipment were damaged: the stations lost their link to the distribution system operator, but electricity production continued. At the power plant, detection software blocked a data-wiping program. CERT Polska linked the infrastructure used to a group known as Berserk Bear or Dragonfly, associated with Russia, and called it the first publicly described destructive activity by this group (CERT Polska).

How they got in, in Poland. According to CERT Polska, in all cases the attackers entered through internet-facing perimeter devices configured as VPNs and firewalls, with logins that did not require multi-factor authentication. For the manufacturing company a configuration stolen earlier and posted on a criminal forum was used (Help Net Security). A follow-up report in August 2026 described a fourth attack on the same day on a smaller plant, with a steam turbine briefly shut down, and access through a misconfigured private mobile network (CERT Polska).

What is not known. The costs of the three episodes, whether there was insurance cover and, for Romania, the perpetrator and the way in have not been made public.

From data to physical damage

The risk changes nature. A data theft produces notification costs and liability. Altered pressure in a waterworks produces broken pipes and customers without water. When an attack reaches the plant, the loss moves from the cyber policy to property and liability policies, and the question becomes which one responds.

Silent cyber comes back into play. Many property policies have excluded or clarified cyber risk in recent years. Physical damage caused by an attack can fall between the two covers: excluded from the property policy, not provided for in the cyber policy. The Danish and Polish cases show the scenario is not theoretical.

Separating office IT from plant systems matters. In Romania the encryption stopped at office systems and the water kept flowing (eSecurity Planet). In Poland the attackers reached field devices. For underwriters, separation between the two networks is the data point that distinguishes an interruption claim from a claim with physical damage.

State actors and exclusions

Three episodes, three different attributions. In Denmark the attribution is official, from an intelligence service. In Poland it comes from CERT Polska, the national technical body. In Romania there is no attribution. State-attack exclusions that require attribution by a government would apply differently in the three cases.

Critical infrastructure, the most sensitive point. Exclusions introduced in recent years often focus on attacks that impair the functioning of a state's essential service. Water and energy are the typical case. An attack like the Polish one, had it stopped production, would have been close to the threshold of these clauses.

The insured does not choose the attacker. A water utility or energy producer cannot foresee whether it will be hit by criminals or by a state group. The wording must make clear in advance how an attack attributed after the loss is treated, even months later, as in Denmark.

Aggregation on infrastructure

More than 30 plants on the same day. In Poland the same attacker hit dozens of plants with different owners using the same technique (CERT Polska). For a portfolio of renewable energy producers, often small and numerous, it is a concrete aggregation scenario.

The same weakness everywhere. Perimeter devices exposed without multi-factor authentication, and private mobile network configurations that CERT Polska says are common outside Poland too. A weakness shared by many insureds is the starting point of an aggregation event.

The small operator is the most exposed. A local waterworks like Tureby Alkestrup has limited resources for security. Its head's advice to get insured (Euronews) points to demand for cover arriving exactly where controls are weakest.

What to bring to renewals

Impact for insurersHigh

In one month, attacks attributed or linked to Russia hit water and energy plants in Denmark and Poland, with burst pipes and dozens of plants damaged, while ransomware stopped Romania's water authority.

On the portfolio side, the December cases suggest counting how many energy and water insureds use the same perimeter devices and the same communication networks. A coordinated state attack on dozens of small plants is an aggregation scenario that should be tested together with the exclusions, because that is where the portfolio limit and the wording meet.