Cyberattack on power grids ‘not science fiction,’ expert warns

Dutch cybersecurity experts have been closely monitoring a major power outage affecting Spain and Portugal, raising concerns about the vulnerability of critical infrastructure. Initially, there were fears that a cyberattack could be behind the widespread disruptions. However, Spain's grid operator has since confirmed that the outage was not caused by a cyberattack.

While Spanish authorities have attributed the outage to weather-related factors, experts in the Netherlands cautioned that similar issues with critical infrastructure could be caused by cyberattacks. Dave Maasland, director of the cybersecurity firm ESET, emphasized the growing risk of cyberattacks on critical infrastructure. He warned that power grids remain vulnerable to such attacks, even if the current outage was not caused by one.

“A cyberattack on power infrastructure is not science fiction,” Maasland said. “Attacks on power supplies are possible and have already caused disruptions in the past.”

He pointed to several examples of cyberattacks on power grids, including the 2015 attack by Russian hackers that disabled power systems in western Ukraine. A similar attack occurred in Kyiv in 2016. More recently, a cyberattack on Ukraine’s power grid was narrowly avoided in 2022, after Russia's invasion. Maasland described the malware used in these attacks as a “digital hand grenade,” designed to not only disrupt power but also destroy critical systems, complicating recovery efforts.

While experts had initially considered a cyberattack as a possible cause of the ongoing power issues in Spain and Portugal, Maasland cautioned against jumping to conclusions. “A power network can fail for a variety of reasons, including human error or faulty equipment,” he said. “Sometimes, the fear of a cyberattack may be a strategy in itself, aimed at sowing panic and chaos.”

The power outage has impacted large parts of Spain and Portugal, including major cities like Madrid, Barcelona, and Lisbon. As authorities continue their investigation, the Dutch National Cyber Security Centre (NCSC) is advising citizens to prepare for the possibility of similar future disruptions in the Netherlands. The NCSC’s Denk Vooruit ("Think Ahead") initiative encourages the public to assemble emergency kits with bottled water, non-perishable food, cash, and blankets to prepare for power outages that could last up to three days.

The Red Cross in the Netherlands echoed the NCSC’s advice, emphasizing that even short-term power outages could lead to widespread panic and social unrest. "The risk of a blackout may seem distant, but it's closer than we think," said a Red Cross spokesperson. "A little preparation goes a long way."

As the investigation continues, Maasland urged the Dutch public to stay informed and take proactive steps to prepare for potential disruptions. "The threat of cyberattacks targeting critical infrastructure is a reality, and it’s important to take steps now to be ready for potential disruptions," Maasland added.