Some believe a cyberattack or a cover-up is behind the day Spain and Portugal went dark in seconds. The first official-sounding explanation was disowned within a day, and the final report still has blanks.
"El cero"
On April 28, 2025, a massive power cut hit Spain, Portugal and part of south-west France. Madrid, Barcelona and Lisbon went dark. Trains, traffic lights and even the Madrid Open tennis tournament stopped. Spain's operator Red Eléctrica called it "el cero," the zero.
The Guardian's explainer captured the confusion of the first day. Portugal's prime minister said the problem started in Spain, and Red Eléctrica made no statement on causes. Early reports blamed a "rare atmospheric phenomenon," citing the Portuguese operator REN. The next day REN said the statement had been falsely attributed to it. European Council president António Costa said there was no evidence of a cyberattack, but cautioned that the real cause was still unclear. That gap between "no evidence" and "unclear" is where the theories moved in.
Forty-eight hours of suspects
Spanish fact-checker Newtral tracked the stories that filled the vacuum. Within hours, posts blamed a cyberattack by Russia, Israel, Morocco or Algeria. The Morocco version leaned on a Servimedia news agency report that attributed to Spain's National Cryptologic Center, part of the CNI intelligence service, talk of "great unusual activity coming from North Africa." The intelligence service distanced itself, and one outlet that repeated the claim published a correction.
Other narratives said the European Union had sabotaged Spain to test its population, as a social experiment like the pandemic, or that the blackout was linked to sanctions on Russia. Some claimed the government caused it to bury the court case against the prime minister's brother. Red Eléctrica's operations director, Eduardo Prieto, said there had been no intrusion into the company's control systems. Prime Minister Pedro Sánchez said he was not ruling out any hypothesis.
https://www.newtral.es/desinformacion-apagon-ciberataque-marruecos-argelia-narrativas/20250430/
The renewables fight
The second Guardian piece asked the question that split Spanish politics: did renewables play a part? The weather that Monday was normal. REN denied it had made the atmospheric statement but gave no further details. Portugal's government said it had no information about a cyberattack or hostile act "at this stage."
Then came inertia. Gas and nuclear grids have high inertia, a resistance to sudden frequency changes, while grids running heavily on solar and wind have less, and can be less able to absorb a shock unless that is mitigated. One expert said the days before had seen even more renewables on the system, so wind and solar alone could not be blamed, but that they may have made a disturbance harder to absorb. University of Reading professor David Brayshaw said the system now had less inertia, so imbalances had to be corrected faster. For critics of Spain's rapid green build-out, that was the real story.
An atmospheric phenomenon no one would own
Carbon Brief's Q&A on what was and was not known traced the strangest claim to its roots. News agencies, citing REN, blamed a "rare atmospheric phenomenon," later described as an "induced atmospheric vibration." An engineer writing in The Conversation said it was not a commonly used term. REN then said the statement had been wrongly attributed to it. Red Eléctrica, according to El País, preliminarily ruled out a cyberattack, human error or a weather or atmospheric phenomenon.
Later reports confirmed a timeline of oscillations between 12:00 and 12:30, an uncontrolled rise in voltage, generation losses between 12:32 and 12:33, and then collapse. Spain's government concluded it was a failure to manage voltage, contrary to early speculation about low inertia and renewables. Believers point out that the first explanation came with a source attached and lost that source a day later.
https://www.carbonbrief.org/qa-what-we-do-and-do-not-know-about-the-blackout-in-spain-and-portugal
The official verdict
On March 20, 2026, ENTSO-E, the European network of grid operators, published its expert panel's final report. The panel had 49 members, including grid operators, regional coordination centers, the EU regulator ACER and national regulators, chaired by experts from two operators that were not affected.
The conclusion is that the blackout came from many interacting factors: oscillations, gaps in voltage and reactive power control, differences in voltage regulation practices, rapid output reductions and generator disconnections in Spain, and uneven ability to stabilize the system. Together these produced fast voltage increases and a cascade of disconnections. ENTSO-E called it a first-of-its-kind event. Overvoltage, not hackers, is the official answer. For those who still suspect a deliberate act, a list of many interacting factors with no single cause is exactly the kind of answer that leaves room.
What 440 pages could not explain
pv magazine's reading of the 440-page report shows how the final seconds unfolded. Key voltage control equipment was switched manually. Several conventional plants delivered less than 75% of the reactive power the operator asked for. Many renewable plants ran on fixed power factor schemes and disconnected before reaching their required voltage thresholds, some with overvoltage protection set below regulatory limits. More than 2.5 GW was lost, voltages passed 435 kV, and at 12:33:19 Spain and Portugal lost synchronism with Europe.
The report also admits gaps. Distribution operators had no actual production data from generators under 1 MW, mostly rooftop solar. Several plant owners said they had no fault records to explain disconnections before the blackout. Those data gaps meant the experts could not determine the cause of some disconnections. The official story is detailed, but it still contains unexplained trips. Cyberattack, renewables or simple mismanagement: vote on what you believe happened.