Two cybercriminal collectives, Dark Storm Team and NoName057, have claimed to be behind the blackout that plunged Spain and parts of Portugal and France into darkness on Monday. In messages shared on the social media platforms Telegram and X, the pro-Russian hacking groups posted links to supposedly compromised Portuguese government networks.
Posting on X the Darkstorm handle shared the message: "Isn't it funny to cut off electricity to countries from home?", and the messages have shared links which claim disruptions to major Portuguese ministries such as the Ministry of the Interior, Ministry of Justice, Ministry of Environment and Climate Action and The Presidency of the Council of Ministers.
It's reported the internet test, check-Host data, shows these services were either down or experiencing degraded performance at the time the hacker group was posting.
Online hacking monitoring site Leakd reported that despite no malign hacking state being officially confirmed by investigators of the outage, NoName057 is a known pro-Russian hactivist group which the site says has "previously been linked to operations targeting NATO-affiliated nations and institutions critical of Russian foreign policy".
It added that while there was no confirmation the "blackout was directly caused by a cyberattack, the implications are chilling".
According to the site, if it is proved to be a cyberattack then it would be one of the biggest since an attack on civilian sites in Europe.
The cause of Spain and Portugal's widespread blackouts remained a mystery today (Tuesday), with some isolated disruption remaining after power was largely restored to both countries.
One of Europe’s most severe blackouts grounded flights, paralysed metro systems, disrupted mobile communications and shut down ATMs across the Iberian Peninsula on Monday.
By 7am. on Tuesday more than 99% of energy demand in Spain had been restored, the country's electricity operator Red Eléctrica said. Portuguese grid operator REN said all 89 power substations were back online and power had been restored to all 6.4 million customers.
As life began to return to normal — with schools and offices reopening, traffic easing and public transport restarting — the authorities in Spain have yet to provide further explanations for what caused one of the most serious blackouts to ever take place in Europe.
The Southern European nation of 49 million people lost 15 gigawatts, equivalent to 60% of its national demand, in just five seconds.
On Tuesday, Prime Minister Pedro Sánchez said that the government's priorities were twofold: restoring Spain's electrical system and finding the causes of the blackout so that a similar event “never takes place again.” Such widespread electric failure has little precedent on the Iberian Peninsula or in Europe.
Eduardo Prieto, director of services for system operations at Spain's electricity operator, noted two steep, back-to-back “disconnection events” before Monday's blackout. Speaking at a press conference on Tuesday he said more investigation was needed to understand why they took place.
Spain’s meteorological agency, AEMET, said that it had not detected any “unusual meteorological or atmospheric phenomena” on Monday, and no sudden temperature fluctuations were recorded at their weather stations.
Portugal’s National Cybersecurity Center has so far dismissed speculation about foul play, saying there was no sign that the outage resulted from a cyber attack.
European Council President Antonio Costa also said there were “no indications of any cyber attack,” while Teresa Ribera, an executive vice president of the European Commission, also ruled out sabotage.
Nonetheless, the outage “is one of the most serious episodes recorded in Europe in recent times,” she said.