What happened

In a first wave on 11 May 2023, attackers exploited a critical command-injection vulnerability (CVE-2023-28771) in Zyxel firewalls to compromise 11 of 16 targeted Danish energy companies, reading device configurations and credentials. A second, more sophisticated wave beginning 22 May exploited two Zyxel zero-day vulnerabilities not patched until 24 May, and SektorCERT said attackers in this phase reached the industrial control systems of multiple companies. In total, 22 Danish energy-sector organizations were compromised across the two waves. Some operators deliberately disconnected from the wider grid and ran in island mode, generating and distributing power locally, as a precaution. SektorCERT described the campaign as the largest coordinated cyberattack on Danish critical infrastructure to date. The marker is placed at a national reference point since the affected companies were not individually named in the cited reporting.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.