On 28 April 2025 at 12:33 CEST, continental Spain and Portugal lost power. The ENTSO-E expert panel's published findings attribute the blackout to a combination of many interacting factors in the power system, not a single cause. The panel's page does not mention a cyber attack or any cyber cause.
What the panel found
ENTSO-E's page lists the interacting factors: oscillations, gaps in voltage and reactive power control, differing voltage regulation practices, rapid output reductions and generator disconnections in Spain, and uneven stabilisation capabilities. These led to fast voltage increases and then cascading generation disconnections in Spain.
The panel was set up on 12 May 2025 with 49 members from transmission operators, regional coordination centres, ACER and national regulators, chaired by experts from two unaffected operators. It published a factual report on 3 October 2025 and its final report on 20 March 2026.
What it recommended
The panel recommends stronger operational practices, better monitoring of system behaviour, closer coordination and data exchange between actors, and regulation that adapts to a changing power system. It says the solutions are already technologically deployable.
Why it belongs in a security reading list
Large failures draw speculation about attacks. Having a method to tell causes apart is a security skill. The panel took months, used operational data, and published a factual report before the final one.
It also shows a point that security teams know and operations teams know too: complex systems fail through interactions between components that each look fine alone. Cascading failure shows up in power grids, cloud regions and release pipelines.
How to talk about it
When a story like this breaks, security teams are often asked on day one whether it was an attack. A good answer is short: here is what we have checked, here is what we have not, and here is when we will know more. The panel's own timeline shows why. It formed within two weeks, published facts five months after the event and a final report almost a year after it.
Practical lessons
- Do not announce a cause on day one. Record what you observe and what you do not know.
- Separate the question of who did this from what failed. Recovery needs the second answer first.
- Look for interactions, not only single points of failure. Ask what happens when two normal behaviours meet.
- Share data across organisations before an event, so an investigation can be done at all.
- Rehearse restart. Black start procedures are part of resilience planning.
- Keep operational monitoring detailed enough for a post-event reconstruction.
See also how to tell an outage from an attack.
Where Safeguard fits
This incident is not a software supply chain event, and Safeguard does not monitor power systems. The general habit it supports, keeping an inventory and evidence of what you run, applies to any critical service. A free scan is at gold.safeguard.sh/scan.
Quick check
Did the ENTSO-E panel link the Iberian blackout to a cyber attack?
The panel's published page attributes it to many interacting factors and does not mention a cyber attack or cyber cause.
When were the panel reports published?
The factual report on 3 October 2025 and the final report on 20 March 2026.
Sources
Last reviewed: 19 October 2026.
