Spain declares blackout investigation over suspected cyberattack “secret” as judge points to GRU-backed disruption of Ukraine’s power supply

Spain’s National Court has designated the investigation into the recent large-scale blackout as “secret” amid suspicions that it may have been caused by a cyberattack. Judge José Luis Calama made the decision on April 29 at the request of prosecutors, according to a report by news agency Europa Press. The full court order is not available in the public domain.

Calama stated that the move was intended to “prevent a situation that could seriously affect the outcome of the investigation.” Making the case classified, he said, would reduce the risk of sensitive information leaking or the investigation being compromised.

The inquiry was formally opened on April 29 by Judge Calama himself. Although the exact cause of the blackout has not been confirmed, cyberterrorism is being considered as one of the possible explanations. Calama has ordered the National Cryptologic Center and grid operator Red Eléctrica to submit reports within 10 days on the likely causes of the outage. The police have also been instructed to compile a preliminary report on its nationwide impact.

The judge stated that the incident took place on Monday at approximately 12:30 p.m., disrupting computer systems that support critical infrastructure sectors including healthcare, energy, industry, and transportation. The impact, he said, created “a critical situation for the well-being and sense of security of all citizens.”

According to the ruling, the government reported that 15 gigawatts of electricity — around 60% of the country’s total consumption at the time — were abruptly lost for five seconds, an event described as unprecedented.

The court order also mentions that, under Article 573 of Spain’s Penal Code, cybercrimes can be classified as acts of terrorism if they are intended to undermine the constitutional order or seriously destabilize essential public services. Calama warned that interdependence among critical infrastructure systems can lead to cascading failures — precisely what appears to have occurred on April 28.

To illustrate the threat, the judge referenced the Ukrainian blackout of 2016, which is widely believed to have been the result of a state-sponsored cyberattack.

In December 2015, hackers successfully disrupted electricity supply in Ukraine by gaining remote access to control systems at the Prykarpattyaoblenergo energy company, installing malware and switching off power remotely. This marked the first known successful cyberattack to cause a power outage, according to researchers at the SANS ICS cybersecurity center.

Ukraine’s Security Service (SBU), Western intelligence agencies including the NSA and CERT, and private firms such as FireEye and ESET, attributed the attacks to the hacking group Sandworm. The Insider previously confirmed that the group is linked to Unit 74455 of the GRU, Russian military intelligence agency. A second, more advanced cyberattack followed in December 2016, this time targeting Kyiv. The hackers deployed a sophisticated malware tool known as Industroyer (also called CrashOverride), specifically designed to disable power substations.