Spain and Portugal power blackouts: was there a cyberattack?

Electricity has already been restored to 99% of Spain and most of Portugal by Tuesday morning. But officials are still hunting for answers – what caused the massive power outage?

Lights are again on in most cities across Spain and Portugal, countries most harshly affected by a huge power outage on Monday.

Barely a corner of the peninsula where almost 60 million people live escaped the blackout. Millions had to spend time without web coverage on their phones, thousands were stranded on trains and in airports.

Cloudflare also said in a detailed blog post that internet traffic dropped massively in both countries as the power grid failed. Impact was detected in parts of Andorra, France, Morocco, and even Belgium.

However, less than a day later, power is mostly restored, and only a few hundreds of thousands of people remain without electricity.

Still, no specific cause for the shutdown has emerged thus far – and speculation always quickly fills the void. Could the massive outage have been a cyberattack?

What exactly happened?

Neither Spain’s prime minister Pedro Sanchez nor indeed any official source has so far explained what could have caused the unprecedented energy shutdown. But various hypotheses have already emerged, and it’s all a bit chaotic.

For instance, Portugal’s electrical grid operator, REN (Redes Energeticas Nacionais), blamed the outage on a “fault in the Spanish electricity grid,” Reuters reported on Monday.

“Due to extreme temperature variations in the interior of Spain, there were anomalous oscillations in the very high voltage lines (400 KV), a phenomenon known as induced atmospheric vibration,” REN said.

“These oscillations caused synchronisation failures between the electrical systems, leading to successive disturbances across the interconnected European network.”

This weirdly confident statement was soon denied by sources in that very same organization. Spanish officials, though, can’t really explain the cause of the incident.

Grid operator REE did say that the blackout was due to a sudden, large drop in power supply that caused the grid interconnection between Spain and France to trip, and that the network then lost 15 gigawatts of electricity generation in five seconds.

But officials haven’t explained the ultimate reason for that loss – hence the speculations that it could have been caused by a cyberattack.

Hacking hit possible but unlikely

Juan Manuel Moreno, the premier of Andalusia, the most populous autonomous community in Spain, seemed sure when he spoke of a cyberattack as a possible culprit on Monday.

He stated: “Everything points to the fact that a blackout of this magnitude could only be due to a cyberattack.” But Moreno later acknowledged this was his own conclusion, reached without any sort of confirmation from the national government.

Besides, a little later on Monday, the Vice President of the European Commission, Teresa Ribera, said there were no “indications that the blackout was deliberately caused.”

Spain, an active supporter of Ukraine, the country has become one of the most targeted by cyberattacks considered critical due to their severity, especially since the invasion by Russia, with several hundred each year.

Antonio Costa, President of the European Council, who worked as Portugal’s prime minister from 2015 to 2024, also said there were no signs of a cyberattack. Finally, REE ruled out a cyberattack as the cause of the outage.

However, Spain’s National Institute of Cybersecurity (INCIBE) had earlier announced it was investigating whether there was some kind of cyberattack behind the blackout. The national cryptologic centre CCN has also been mobilized.

That doesn’t mean hacking was involved, of course. Still, Spain's High Court said on Tuesday that it would open an investigation to find out whether it could have been caused by a cyberattack..

According to El Pais, Spain, an active supporter of Ukraine, the country has become one of the most targeted by cyberattacks considered critical due to their severity, especially since the invasion by Russia, with several hundred each year.

Unsurprisingly, Ukraine is the only country where attacks of a somewhat similar nature occurred in the past. In 2015, for instance, a Russian hacking group known as Sandworm – linked to the Russian military – hacked the power grid in Western Ukraine. Sandworm also attacked Ukraine’s power supply just weeks into the official start of the war in 2022.

However, experts say it’d be extremely difficult – even if possible, nevertheless – to prepare and execute a cyberattack that would shut down the electricity of two entire countries.

“An attack, for example, could target transformers or substations, causing damage to hardware until it starts to fail. But coordinating such a large and synchronized attack would be extremely difficult,” Lukasz Olejnik, an expert from King’s College London, told El Pais.

Two sides of a coin

Most officials and professionals of the energy industry say this sort of widespread failure is extremely unusual. But there have been similar incidents in the past.

In 2003, a problem with a power line between Italy and Switzerland caused a huge outage in Italy for about 12 days. And after an incident in Germany in 2003, outages were reported as far away as Morocco and Portugal.

The reason these issues spread quickly is the interconnection of the power lines between countries. However, it also helps to prevent problems from getting worse.

Indeed, the larger system can work as a de-escalatory tool and a buffer. The interconnector between Spain and France probably made it easier to bring the system back online rather quickly.