When the rain hits Spain, there’s trouble

Spain and Portugal plunged into darkness this week as a massive power outage knocked out infrastructure across the Iberian Peninsula. It is a lesson in the need to prepare for the unexpected.

Heavy rainfall in Spain that lasted for several weeks earlier this year led to significant flooding across the country, disrupting transportation, damaging infrastructure, and forcing evacuations.

Spaniards were still reeling from disastrous rains in October, with many blaming national and local authorities for being too late to send emergency alerts. Now, Spain – and Portugal – were hit by a different kind of storm.

Massive blackouts caused widespread chaos and brought streets to a standstill as the two countries were caught off guard by a sudden shutdown of a power grid on April 28th.

Authorities responded promptly, and power was largely restored across the affected regions by the next morning. Both Spain and Portugal ruled out a cyberattack as the cause of the blackout, even though the investigation continues.

Still, the incident raised debates about vulnerabilities in infrastructure preparedness – an issue which countries are not immune to.

Numerous provinces and municipalities in the Netherlands went temporarily offline this week due to a large-scale DDoS attack claimed by the Russian hacking group NoName057(16). The group said it carried out the attack because the Netherlands provided military and financial support to Ukraine.

As millions of aging devices with fast internet connections reach the end of their life cycle, DDoS attacks are poised to become an even bigger cybersecurity nightmare, with a record-breaking botnet larger than many countries already wreaking havoc on global web services.

The Vatican is both a cautionary tale and a success story. After suffering internal leaks a decade ago and a cyberattack by the China-linked group RedDelta in 2020, the world’s smallest state has since turned itself into a digital fortress.

There are good examples of what pre-emptive action can look like. Last week, the British government banned the export of video game controllers to Russia as part of its latest package of sanctions against the Kremlin.

The move followed reports that the Russian military has been using off-the-shelf video game controllers to pilot deadly drone attacks in Ukraine.

There’s some solace in the fact that bad actors fail too. Anonymous, a hacker collective, claimed earlier this month that it leaked 10T of data exposing Kremlin secrets, corruption, and pro-Russian ties in the West – even though some observers noted the leaked data was “old news.”

Meanwhile, researchers at Cybernews uncovered that an app called WorkComposer, used to monitor employees, leaked 21 million real-time screenshots onto the open web. Taking extra steps to bolster security is welcome, but turning workplaces into surveillance zones risks going too far.

Our researchers also found that a Second Phone Number app, with millions of downloads in the US App Store, exposed users’ data – including messages, media files, and sender and recipient details.

On top of that, we have reported on an alleged leak affecting an online gaming platform Roblox, which reportedly exposed 900,000 accounts.

More than 1,700 sensitive documents were also inadvertently shared publicly via ANY.RUN, an interactive online sandbox, after Microsoft Defender mistakenly flagged legitimate Adobe Acrobat Cloud links as malicious.

In cybersecurity, as in life, fair weather never lasts – it’s better to carry an umbrella.