# The 2025 Iberian Peninsula blackout was a deliberate cyberattack or engineered sabotage, not a technical grid failure **Verdict: Contradicted.** That a massive blackout hit Spain and Portugal on 28 April 2025 is not in dispute: roughly 31 GW of load vanished in seconds and power was out for about ten hours across most of the peninsula. The claim we rate is narrower, that the collapse was a deliberate cyberattack or an engineered event. That claim is debunked. Spain's government ran what it called its largest-ever cybersecurity investigation and found no evidence of a cyber-incident; Portuguese officials pointed to a transmission-network problem originating in Spain; and the ENTSO-E expert panel attributed the cascade to a voltage surge that tripped protective shutdowns within about thirty seconds. Two pro-Russian hacktivist groups boasted of causing it, but no investigator found any intrusion behind the outage. Category: Science, Space & Technology · Era: 2020s · First circulated: 28 April 2025, within hours of the outage, as pro-Russian hacktivist groups claimed responsibility on social media and false posts blamed a cyberattack variously attributed to Russia, Morocco or North Korea · Believed by: A large online audience during the outage and the days after; amplified by pro-Russian hacktivist channels and by accounts that recycled a fabricated CNN and von der Leyen quote, with softer suspicion lingering among people who distrust official grid operators or oppose the renewables build-out URL: https://theconspiratory.com/theory/iberian-blackout-2025 ## Summary At 12:33 CET on 28 April 2025, the electricity systems of mainland Spain and Portugal collapsed almost simultaneously. About 31 GW of demand dropped off the grid within seconds; trains stopped, traffic lights died, phone networks failed, and most of the peninsula went dark for roughly ten hours. Into that alarming silence rushed a cyberattack story. Two pro-Russian hacktivist groups claimed credit, and viral posts pinned the blame on Russia, Morocco or North Korea, some citing a CNN report and a Ursula von der Leyen quote that were never real. This case file keeps two things apart: a continent-scale blackout with a technical cause; and the claim it rates, that it was a deliberate attack. On the attack claim, the official findings are consistent and the verdict is debunked. What survives is a legitimate, and quite different, debate about grid resilience, voltage control and how modern power systems ride through disturbances. ## The claim That the 28 April 2025 Iberian blackout was not an ordinary technical failure but a deliberate act: a cyberattack on the Spanish and Portuguese grids (attributed by various tellings to Russia, Morocco or North Korea, or claimed by pro-Russian hacktivists), or an engineered event staged to justify tighter central control of the grid, or covert proof that the renewable-heavy Spanish system was sabotaged. In every version, a hidden hand intentionally switched off the lights and the true cause is being hidden behind a bland technical explanation. ## Origin and timeline - 2025-04-28: At 12:33 CET the Spanish and Portuguese grids collapse together, shedding about 31 GW of load in seconds. Most of mainland Spain and Portugal loses power; transport, payments and telecoms fail. Restoration takes roughly ten hours in most areas, stretching into the night. - 2025-04-28: Within hours, two pro-Russian hacktivist collectives, Dark Storm Team and NoName057(16), claim joint responsibility online, posting that they had cut electricity in NATO countries. No technical detail accompanies the boast. - 2025-04-28: False and misleading posts spread fast. Some blame a Russian, Moroccan or North Korean cyberattack; others circulate a fabricated CNN report and a quote falsely attributed to European Commission president Ursula von der Leyen. Several outlets, including Reuters, briefly report that Portugal's grid operator REN blamed a rare atmospheric phenomenon; REN later says it issued no such statement and the outlets correct the record. - 2025-04-28: Spain's grid operator Red Eléctrica says its early analysis shows no intrusion into its systems. European Council president António Costa says there is no indication of a cyberattack. - 2025-04-29: Portuguese officials attribute the event to a problem on the transmission network originating in Spain, pushing back on the idea that Portugal was the source or that a hostile actor was involved. - 2025-05: The World Economic Forum and cybersecurity commentators note the key distinction: this blackout was not a cyberattack, but the threat to power grids from real cyber operations is genuine, which is part of why the attack story felt plausible. - 2025-05-15: Spain's government rules out a cyberattack. Secretary of State for Energy Sara Aagesen describes the largest cybersecurity investigation ever conducted in the country and states there is no evidence of a cyber-incident or cyberattack as the cause. - 2025-06-17: Spain's official report attributes the blackout to a combination of technical failures, including voltage-control shortcomings and planning gaps in how reactive power was managed, and again rules out a cyberattack. - 2025-10-03: The ENTSO-E expert panel publishes its factual report, attributing the collapse to fast voltage rises and cascading generator disconnections that developed over roughly thirty seconds. Its final report, with recommendations, follows in March 2026. Neither finds any sign of a deliberate attack. ## The evidence, claim by claim - Claim: Pro-Russian hacktivists claimed responsibility, which shows the blackout was a cyberattack. Evidence: A claim of credit is not evidence of causation. Dark Storm Team and NoName057(16) are known for disruptive denial-of-service actions and opportunistic boasting, and they offered no technical proof of having caused a grid collapse. Red Eléctrica found no intrusion, and Spain's national cybersecurity review, examining more than 300 GB of data, found no cyber-incident. Groups routinely take credit for events they did not cause to inflate their profile; that is what the investigations conclude happened here. - Claim: It was a foreign cyberattack by Russia, Morocco or North Korea, later covered up. Evidence: The attribution shifted from post to post, which is a hallmark of rumour rather than intelligence. No government or grid operator identified any hostile intrusion. Spain's government called its probe the largest cybersecurity investigation in the country's history and found no evidence of an attack; Portugal traced the disturbance to the Spanish transmission network; the ENTSO-E panel found a technical cascade. The naming of three different countries, with no consistent evidence for any, points to viral speculation, not a concealed culprit. - Claim: A fabricated CNN report and a von der Leyen quote confirmed the cyberattack. Evidence: Both were fakes. The CNN report and the quote attributed to the European Commission president were fabricated and circulated to lend authority to the attack narrative. Separately, several outlets including Reuters briefly reported that Portugal's REN blamed a rare atmospheric phenomenon; REN said it had issued no such statement and the outlets corrected the story. The information around the blackout was polluted with invented sourcing, which is the opposite of a documented cyberattack. - Claim: The blackout was engineered to justify more central control, or to hide that renewables sabotaged the grid. Evidence: This reframes a genuine engineering debate as a plot. The ENTSO-E expert panel identified a combination of interacting factors: voltage and reactive-power control gaps, differences in voltage-regulation practice, rapid output reductions and generator disconnections, and uneven system stabilisation, leading to fast voltage rises and a cascade. High shares of inverter-based renewables raise real questions about system inertia and voltage support, and those are being addressed openly through published findings and recommendations. A hard engineering problem being studied in public is not the same as a covert act of sabotage. - Claim: A blackout this large across two countries cannot be an accident; someone must have switched it off. Evidence: Scale is not a signature of intent. Interconnected grids are engineered so that a local disturbance can, under the wrong conditions, cascade across a wide area in seconds; that is precisely how protective relays and automatic disconnections work. The ENTSO-E panel describes a cascade unfolding over roughly thirty seconds from voltage instability. Historic large blackouts, from the 2003 US and Northeast event to Italy the same year, likewise spread fast from technical faults with no attacker involved. ## Why people believe it - The threat is real, which makes the false version feel credible. State-linked hackers do probe and sometimes disrupt critical infrastructure, and Western agencies warn about it openly, so a grid going dark plausibly reads as an attack even when it is not. - Someone claimed it. Pro-Russian hacktivist groups publicly took credit within hours, giving the theory a named, confident author. A claim of responsibility carries an authority that anonymous rumour does not, even when it is empty. - The information space was flooded with fakes. A fabricated CNN report, a false von der Leyen quote and a wrongly attributed atmospheric-phenomenon statement all circulated, so people encountered official-looking confirmation of an attack that never existed. - The real cause is genuinely technical and hard to picture. Voltage surges, reactive power and cascading protective trips are abstract; a hostile hand flipping a switch is a vivid, graspable story that fills the gap while investigators work. - It maps onto existing arguments about renewables. People already worried that a fast build-out of solar and wind had left the grid fragile could read the blackout as vindication, or as proof of sabotage, folding a real policy debate into the attack narrative. ## Open questions - The precise sequence is still being distilled into lessons. The ENTSO-E factual report identified the voltage cascade, and the final report set out recommendations, but exactly which planning and operational decisions most contributed, and how responsibility is shared between operators, is still being worked through. None of that reopens the attack claim; it refines the technical account. - Grid resilience under high renewables is a legitimate open problem. How much system inertia, voltage support and reactive-power reserve a modern inverter-heavy grid needs to ride through disturbances is an active engineering and policy question, distinct from any question of sabotage. - Accountability remains contested. A year on, debate continued over whether operators and regulators planned adequately for the conditions that day, which is a governance question about competence and oversight, not evidence of a deliberate plot. ## Sources - 2025 Iberian Peninsula blackout, Wikipedia (2026): https://en.wikipedia.org/wiki/2025_Iberian_Peninsula_blackout - Iberian Peninsula blackout sparks spread of false theories online, Euronews (2025): https://www.euronews.com/my-europe/2025/04/29/iberian-peninsula-blackout-sparks-spread-of-false-theories-online - Iberian blackout: Cyberattack is not to blame, but the threat to power grids is real, World Economic Forum (2025): https://www.weforum.org/stories/2025/05/spain-might-not-cyberattack-blackout-power-outage-electric-grids-vulnerable/ - Spanish government rules out that a cyberattack caused nationwide blackout, Spain in English (2025): https://www.spainenglish.com/2025/05/15/spanish-government-rules-cyberattack-caused-nationwide-blackout/ - Spain says April's blackout was caused by multiple technical failures and rules out cyberattack, Euronews (2025): https://www.euronews.com/my-europe/2025/06/17/spain-says-aprils-blackout-was-caused-by-multiple-technical-failures-and-rules-out-cyberat - 28 April 2025 Iberian blackout: Expert Panel investigation, ENTSO-E (2025): https://www.entsoe.eu/publications/blackout/28-april-2025-iberian-blackout/ - ENTSO-E publishes Expert Panel final report on 28 April 2025 blackout in Spain and Portugal, ENTSO-E (2026): https://www.entsoe.eu/news/2026/03/20/entso-e-publishes-expert-panel-final-report-on-28-april-2025-blackout-in-spain-and-portugal/ - Perfect storm of multiple factors behind 2025 Iberia power blackout, experts say, Euronews (2026): https://www.euronews.com/2026/03/20/perfect-storm-of-multiple-factors-behind-2025-iberia-power-blackout-experts-say - Pro-Russian hackers claim responsibility for major power outage across Spain, Portugal, Morocco World News (2025): https://www.moroccoworldnews.com/2025/04/195208/pro-russian-hackers-claim-responsibility-for-major-power-outage-across-spain-portugal/ Rated by The Conspiratory, a neutral, sourced encyclopedia of conspiracy theories. Full page: https://theconspiratory.com/theory/iberian-blackout-2025