AI-like requests raise cyberattack fears among Danish utilities

Several Danish water and district-heating companies have received an unusual number of requests for public records in recent weeks, prompting fears the enquiries could be used to gather information for a cyberattack, DR reports.

The requests appear to have been generated by artificial intelligence, according to the industry groups Danish District Heating, DANVA and Danish Waterworks. They include questions about court cases involving the companies and people who do not appear in their customer databases.

The senders and their motives are unknown. Kim Mortensen, director of Danish District Heating, said the companies were concerned that information could be collected to build a clearer picture of their emergency preparedness. He said several members had received requests from the same email address, which could not be linked to an identifiable person in Denmark.

DANVA, which represents Danish water and wastewater companies, says its members have also been heavily affected. Senior consultant Jens Plesner said the volume of requests, warnings from government agencies about possible criminal activity and reports that some enquiries had been reported to police were causes for concern.

Plesner said requests had asked about court rulings involving water companies. While an individual request might not appear suspicious, he said, hearing that other organisations in critical infrastructure were receiving similar enquiries made the situation potentially serious. He added that waterworks had previously been targeted by hackers.

Education institutions have also received unusual requests, including questions about court cases and the case-management systems used by schools. Authorities have urged the institutions to report the enquiries as IT crime, amid concerns they could be an attempt to obtain sensitive personal data such as exam papers.

Danish Waterworks, which represents smaller, consumer-owned waterworks, said 10 to 12 members had contacted the organisation in recent weeks. They had received requests for personal information from the same private individual, who was not affiliated with the waterworks. The requests were rejected because the information sought was not held in their systems. The organisation passed details to the Agency for Societal Security and Preparedness.

Publicly owned district-heating companies, waterworks and wastewater companies are required to respond to and provide guidance on public-records requests. The industry groups want authorities to issue guidance on how to identify requests generated and sent by AI bots while still complying with the law.