No Evidence of Cyberattack in EU Blackout, ‘Rare Atmospheric Phenomenon’ Identified by REN as Cause 

Key Takeaways

• Spain, Portugal and parts of France were hit by widespread power outages on Monday.
• Portugal’s national grid operator, Redes Energéticas Nacionais (REN), blamed a “rare atmospheric phenomenon” for the blackout.
• Spanish authorities continue to investigate the root cause.

Power cuts across parts of France, Portugal and Spain on Monday, April 28, were caused by a rare phenomenon known as “induced atmospheric vibration,” Portugal’s national grid operator, Redes Energéticas Nacionais (REN), said.

While there was initial speculation that a cyberattack was behind the blackout, REN blamed the cascading effect of extreme temperature variations in Spain’s interior.

Cyberattack Ruled Out, For Now

While power has now been restored across the Iberian Peninsula, the exact cause of the outages remains unclear.

As power cuts spread across Spain, the President of Andalucía, Juan Manuel Moreno, stated that, “everything points to the fact that a blackout of this magnitude could only be due to a cyberattack.”

However, at a press conference on Monday afternoon, Portugal’s Prime Minister, Luis Montenegro, said there was “no indication” that a cyber attack was behind the outages.

Likewise, the Vice President of the European Commission, Teresa Ribera, concluded after communicating with Spanish and Portuguese authorities that there were “no indications” that the blackout was “deliberately caused.”

Portuguese Grid Operator Blames the Weather

In a statement that has since been removed, REN said: “Due to extreme temperature variations in the interior of Spain, there were anomalous oscillations in the very high voltage lines.”

The phenomenon, known as induced atmospheric vibration, has been observed in the past when severe weather conditions have caused power lines to snap or shut down.

However, temperatures across Spain were normal for the time of year on Monday, and there were no major storms or extreme weather events.

Attacks on European Infrastructure

As of Tuesday morning, authorities in Spain continued to investigate the root cause of the power outages.

Although European leaders have dismissed the notion that a cyberattack brought down the electricity network, Spanish authorities are nonetheless investigating the possibility that hackers were involved.

Since 2015, a spring of cyberattacks targeting European infrastructure has originated from Russia.

In 2015, Sandworm, a cyber threat group operated by Russia’s military intelligence service, infiltrated three regional power distribution companies in Ukraine, tripping breakers and taking out substations.

More recently, in 2023, pro-Russian Cyber‐saboteurs triggered emergency brakes on at least 20 freight and passenger trains across northern Poland.

The Czech transport minister has also stated that Russian cyber‑threats have launched “thousands” of attempted intrusions against the country’s railway system since early 2022​.

However, he said Czech cyber‑defenses detected and neutralized the attacks before they could do any damage​.