The Iberian Peninsula experienced a massive and historic blackout on Monday, which left the mainland territories of Spain and Portugal without electricity for hours. “In my more than 40 years in this sector, I have never seen anything like this,” said Jorge Fabra, who for a decade president of Red Eléctrica, the public company that operates the national electricity grid in Spain. In the afternoon, electricity was beginning to be restored in some parts of the country. However, the main question that remains is what exactly happened. “We do not rule out any hypothesis,” said Pedro Sánchez, the country’s prime minister, at a press conference at around 6 p.m. local time “We do not know the causes,” he insisted, thus further increasing the uncertainty surrounding the historic energy collapse.
This is what is known and what is not known about the incident as of Monday afternoon.
When did the power outage start?
At 12:32 p.m. local time, “a very strong fluctuation in power flows” was detected in the electrical grids. This fluctuation was due to a loss of generation, meaning a drop in electricity production, which in Spain comes mainly from nuclear plants, hydroelectric plants, combined cycles, and solar and wind farms.
This power loss was caused by the sudden disappearance of 15 GW of generation for five seconds. To understand the scale of the problem, the five nuclear power plants in Spain have a combined installed capacity of 7.4 GW.
The fluctuation caused by this drop, the causes of which are still being investigated, triggered the disconnection of the Spanish electrical system from the European grid, which relies on an interconnection with France. This disconnection “led to the collapse” of the system and the subsequent widespread blackout, according to Eduardo Prieto, Director of Operations Services at Red Eléctrica, in an initial press conference at 2:30 p.m. Later, at 7:00 p.m., Prieto reiterated this explanation and emphasized that this is an “absolutely exceptional event,” of a dimension never before seen in Spain.
When will the problem be solved?
Prieto had stated at 2:30 p.m. that the full recovery of service in Spain would take between six and ten hours, and that it would be “gradual and progressive.” However, during the afternoon briefing, he no longer specified the number of hours required for the system to be fully restored.
The Spanish government has declared an electricity crisis following the interruption of the power supply, and work has begun to restore the service.
Technicians from Red Eléctrica and electric companies are now working on restoring the voltage, starting in areas close to France. Once the voltage is restored in the system and delivered to the plants, they can start to bring things back to normal. By 5:30 p.m., electricity had been restored in areas of Catalonia, Aragón, the Basque Country, Galicia, La Rioja, Asturias, Navarre, Castile and León, Extremadura, and Andalusia, according to Red Eléctrica. By 6:45 p.m., areas including Madrid, the Valencian Community, Murcia, and Castile-La Mancha had begun to have the power restored. By 9:30 p.m., according to Prieto, 35% of the supply was already covered.
What caused the system collapse?
Neither Prime Minister Sánchez, Prieto, nor any official source has explained what caused this unprecedented energy shutdown. “We are not going to speculate,” insisted official government sources. During his brief statement without taking questions, Sánchez emphasized the need to avoid spreading “information of questionable origin.”
Was it caused by a meteorological phenomenon?
Various hypotheses have emerged about the cause of the blackout, some of which have been debunked.
Reuters reported that REN (Redes Energéticas Nacionais, the equivalent of Red Eléctrica in Spain) had suggested that a strange meteorological phenomenon in Spain could be the origin of the blackout. However, sources from this organization have denied that information, which pointed to a supposed temperature variation in the interior of Spain.
Could it have been a cyberattack?
Since the massive blackout occurred, it has been speculated that it could have been caused by a cyberattack. The first to assert this most firmly was the premier of Andalusia, Juan Manuel Moreno, who stated that, according to information from the regional cybersecurity center, “everything points to the fact that a blackout of this magnitude could only be due to a cyberattack.” Moreno, however, acknowledged that he had reached this conclusion without confirmation from La Moncloa or another institution. A couple of hours later, the Vice President of the European Commission, Teresa Ribera, stated in Brussels that, after being in contact with Spanish and Portuguese authorities, there were no “indications that [the blackout] was deliberately caused.”
The National Cryptologic Center, which operates under the National Intelligence Center (CNI), has limited itself to saying that it is investigating the cyberattack hypothesis. Spain has become one of the countries most targeted by cyberattacks considered critical due to their severity, with several hundred each year. The Joint Cyber Command, which is under the Ministry of Defense, is also investigating the possible cyber origin of the blackout.
Would a cyberattack of this scale be possible?
The preparation and execution of a cyberattack that shuts down the electricity of almost two entire countries is very complex. It requires a coordinated operation that achieves several objectives simultaneously. “A blackout of this scale through a cyberattack would be complicated because there are many segmented electrical networks,” said Martín Vigo, a cybersecurity specialist. And once it happens, analyzing the networks to find the origin of the attack is not easy either. “Cyberattacks on electrical networks are possible both in theory and in practice because energy infrastructures are very complex systems, full of vulnerable points,” said Lukasz Olejnik, an expert from King’s College London. “An attack, for example, could target transformers or substations, causing damage to hardware until it starts to fail. But coordinating such a large and synchronized attack would be extremely difficult.”
Has an attack like this happened before?
So far in Spain, there is no indication that something like this has occurred. The only successful attacks of this scale took place in Ukraine in 2015 and 2016, with Russia being the culprit. “Other cases were simply demonstrations, failed attempts, or mere rumors,” said Olejnik. The official teams responsible for investigating whether there has truly been an attack have all the necessary tools to find out if it did happen: “Speculating now is not very useful: we simply don’t have enough data,” added the expert. “There is no ‘clear symptom’ that would allow us to say with certainty that a blackout like this is due to a cyberattack. Everything we’ve seen so far could also be explained by normal, non-malicious causes. That’s why it’s important to investigate and avoid falling into rumors or misinformation.”
The National Cybersecurity Institute (INCIBE) warned a year ago about the “significant increase in cyberattacks affecting industrial environments and critical systems.” The institution cited the malicious software BlackEnergy as an example, which was used by Russian hackers on December 23, 2015, to sabotage the electricity distributors in the Ukrainian region of Ivano-Frankivsk, causing a blackout that affected 1.5 million people.
The National Security Department (DSN) of the Prime Minister’s Office also warned in its latest report about the “increase in the number, frequency, sophistication, and severity of cyberattacks.” In 2023, the National Cryptologic Center managed about 108,000 incidents; INCIBE handled 83,500; and the Joint Cyber Command of the Ministry of Defense dealt with 1,480. The advisory body to the prime minister warned of the existence of “increasingly sophisticated attackers and growing interconnectivity, which broadens their potential range of action.”