The 2025 Iberian Peninsula blackout was a deliberate cyberattack or engineered sabotage, not a technical grid failure

Why an attack seemed obvious

The cyberattack story did not come from nowhere, and steelmanning it honestly means acknowledging that several real things lined up to make it look plausible in the first hours.

The threat is genuine. Power grids really are a target. State-linked hackers probe critical infrastructure, and Western security agencies publish warnings about pro-Russia groups attacking utilities. Against that backdrop, a grid going dark reads as an attack before it reads as a fault. Anyone who dismissed the possibility out of hand would have been the careless one.

Someone claimed it. Within hours, two pro-Russian hacktivist collectives, Dark Storm Team and NoName057(16), publicly took joint credit, posting that they had cut the electricity in NATO countries. A confident, named claim of responsibility carries a weight that vague rumour does not, and it gave the theory an author.

The scale felt deliberate.Two countries, tens of gigawatts, all at once: intuitively, a failure that big looks coordinated. And a real policy argument was already running in the background about whether Spain's fast build-out of solar and wind had left the system thinly supported, which gave the sabotage framing something concrete to attach to.

The lights went out across an entire peninsula and a known hostile group said it did the deed. Suspecting an attack, in that first hour, was not irrational. It was where the evidence had to be checked, not where it ended.

So the honest case for taking the attack idea seriously is that the danger is real, a capable actor claimed the act, and the event was genuinely alarming. The conspiracy claim then goes further, that the attack happened and the technical explanation is a cover. That is the step the evidence has to bear, and it is where it gives way.

What the investigations found

Once investigators actually looked, the attack story found nothing to stand on, and it found it repeatedly, across independent bodies with no shared incentive to agree.

Spain's grid operator said almost immediately that its early analysis showed no intrusion into its systems. Spain's governmentthen ran what Secretary of State for Energy Sara Aagesen called the largest cybersecurity investigation in the country's history, sifting more than 300 GB of data, and concluded there was no evidence of a cyber-incident or cyberattack as the cause. Portuguese officials attributed the disturbance to a problem on the transmission network originating in Spain, not to any hostile actor.

The decisive technical account came from the ENTSO-E expert panel, a group of dozens of specialists drawn from transmission operators, regional coordination centres and regulators, chaired by experts from unaffected operators. Its factual report attributed the collapse to a voltage surge the grid could not absorb: a combination of interacting factors, oscillations, gaps in voltage and reactive-power control, differing regulation practices, rapid output reductions and generator disconnections, produced fast voltage rises and a cascade of automatic shutdowns that ran its course in roughly thirty seconds. No stage of that account requires, or shows, an attacker.

The hacktivist claim, examined rather than repeated, dissolves. Dark Storm Team and NoName057(16) are known for denial-of-service actions and for boasting; they produced no technical evidence of having caused a grid collapse, and no investigation found an intrusion to match the boast. Taking credit for a disaster you did not cause is a standard way for such groups to raise their profile, and that is what the record shows here.

The fabrications that fed it

The attack narrative did not just lack evidence; it was actively propped up by invented evidence, and tracing those fakes is one of the clearest tells that this was rumour rather than a hidden truth.

A fabricated CNN report and a quote falsely attributed to European Commission president Ursula von der Leyenboth circulated, each dressing the cyberattack claim in the authority of a trusted institution. Neither was real. Separately, several major outlets, Reuters among them, briefly reported that Portugal's grid operator REN had blamed a rare atmospheric phenomenon; REN said it had made no such statement, and the outlets corrected themselves.

The attributions themselves kept moving. In different posts the culprit was Russia, then Morocco, then North Korea, with no consistent evidence tying the blackout to any of them. A real attribution, backed by forensic detail, tends to converge on one actor as evidence accumulates. A rumour cycles through villains depending on the audience. This one cycled.

A theory that has to borrow a fake news report and a fake quote to sound credible is telling you something. The scaffolding was invented, and when it was pulled away nothing underneath was left standing.

The real debate the story buried

The attack theory persists partly because it sits on top of a real argument, and it helps to separate the two so the legitimate one is not discredited by the false one.

There isa serious, open discussion about grid resilience. Modern systems lean heavily on inverter-based generation, solar and wind connected through power electronics rather than the spinning mass of conventional plants, and that changes how a grid supports voltage and rides through disturbances. The ENTSO-E panel's findings on voltage and reactive-power control, and its recommendations, are aimed squarely at this: how to keep a low-inertia, renewable-heavy system stable. Those are hard, real questions, and Spanish authorities also faced pointed questions about planning and whether reserves were arranged adequately for the conditions that day.

The conspiracy version takes that legitimate debate and inverts it. Instead of “the grid had a resilience weakness that engineers are now fixing,” it offers “the renewables were sabotage” or “the blackout was engineered to justify central control.” The difference is not subtle. One claim can be tested, and is being tested, through published data and recommendations. The other assumes a hidden intent for which no investigation found any trace.

The psychology is familiar. A technical cause that unfolds in thirty seconds of voltage physics is abstract and unsatisfying; a hostile hand is vivid and assigns blame to a person. When a fabricated CNN report and a confident hacktivist boast are both floating past in the same hour, the vivid story wins attention, and it keeps winning it long after the boring, documented explanation has arrived.