Blackouts in Spain and Portugal could be a cyber attack

Cybercriminals could be behind two massive national power outages affecting Spain and Portugal on Monday afternoon.

At approximately midday ECT, electrical systems of all kinds started to break down across both nations, with only the countries’ islands unaffected. The French Basque Country is also reported to have suffered “brief power cuts”, according to Le Figaro.

According to Spanish newspaper El País: “the power outages have paralyzed the normal operation of infrastructure, communications, roads – with widespread traffic light failures – train stations, airports, businesses, and buildings,” including incidents involving elevators.

In Portugal, according to newspaper Correio da Manhã, police officers have been sent out into the streets to help with traffic control in the absence of the usual infrastructure to keep vehicles moving. Broadcaster RTP, meanwhile, reports that Vodafone has blamed disruptions to its network on the continuing electricity problems.

Spain’s National Institute for Cybersecurity (INCIBE) is trying to determine if this blackout is as a result of a cyberattack, although it is yet to reach a conclusion. The Portuguese deputy minister for territorial cohesion, Manuel Castro Almeida, told broadcaster RTP 3 – as reported by Correio da Manhã – something similar when asked if the issue could be due to a cyberattack, saying “it’s a possibility, but nothing has been confirmed”.

Castro Almeida also suggested Germany and Morocco had been affected, too.

If these power outages are proven to be the result of a cyberattack, it will be the most significant attack of its kind since the BlackEnergy attacks on Ukraine in 2015 and far more wide reaching. While BlackEnergy affected hundreds of homes in western Ukraine, this incident is affecting millions of people across the Iberian Peninsula and hundreds in at least one other country, if not more.

An attack complex enough to put such a huge swathe of western Europe in the dark would be no small undertaking. While there have been some cases of undersea cables being severed between North Africa and Europe in the past, they have led to localized disruption rather than something affecting an entire nation.

It’s unlikely, though not impossible, that such a feat could be achieved by an individual hacking collective. Most previous attacks on energy infrastructure – including DarkEnergy and Stuxnet – have been blamed on nation state actors, although nobody has ever claimed responsibility for them.