Spain concludes largest cybersecurity investigation in its history
The cause of the massive Spanish blackout on April 28, 2025, wasn’t singular. According to the final report from the national investigation committee, three main factors contributed to the outage, including a critical miscalculation of thermoelectric resources required to regulate grid voltage.
Presented by Vice President and Minister for Ecological Transition, Sara Aagesen, the report outlines a cascading sequence of events that destabilized the national grid and led to a complete shutdown of the mainland transmission system.
The investigation, led by two working groups analyzing over 300 GB of data, ruled out a cyberattack. The team instead built a detailed timeline of the incident, making this the most extensive cybersecurity operation ever conducted in Spain.
“In just 49 days, half the time set by EU procedures, the committee delivered a rigorous and verified diagnosis that will help us strengthen our grid,” Aagesen said. “This will be the basis for fast, effective reforms. The council of ministers will approve a set of measures next week.”
Timeline of the April 28 blackout
So, what really caused the 2025 Spanish blackout? And was it, as some critics of the energy transition claimed, the fault of solar power?
To understand what happened, the timeline published on the website of Spain’s ministry for ecological Transition is particularly helpful and is reported here in full.
Phase 0: Voltage instability
In the days leading up to the blackout, voltage fluctuations were already present. On the morning of April 28, they became unusually intense.
Phase 1: System oscillations (12:00–12:30)
At 12:03 pm, the grid experienced an abnormal 0.6 Hz oscillation, causing significant voltage fluctuations for 4.42 minutes. The grid operator activated mitigation protocols: reinforcing the network (constrained by low demand) and reducing power flow to France. These actions dampened the oscillation but led to increased voltages. At 12:16 and again at 12:19, further oscillations occurred, one smaller and another typical of pan-European disturbances, requiring the same mitigations and again raising voltage levels.
Phase 2: Generation loss (12:32:57–12:33:18)
Voltage began rising rapidly. Several generators in Granada, Badajoz, Segovia, Huelva, Seville, Cáceres, and other provinces disconnected in succession.
Phase 3: System collapse (12:33:18–12:33:30)
The rising voltage triggered a chain reaction of shutdowns due to uncontained overvoltage. Each disconnection further raised voltage levels. Frequency also dropped, leading to loss of synchronization with France, a breakdown in continental interconnection, and grounding of the Spanish mainland grid.
The real cause of the Spanish blackout
The committee concluded that the blackout stemmed from multiple compounding factors:
1. Inadequate voltage control capacity.
This was partly due to only a small number of synchronous thermal plants being activated, some of which responded incorrectly to demand.
“REE, the grid operator, told us they had run the numbers and believed activating more thermal plants was unnecessary,” said Aagesen. “They had only scheduled those plants for early hours, not midday.”
2. Grid reconfigurations driven by oscillations.
These made it harder to stabilize voltage levels.
3. Disconnection of power plants.
Some disconnected before voltage limits were breached (set between 380 kV and 435 kV on the transmission grid), while others shut down later as a protective measure.
The ministry clarified: “There was a shortage of voltage control resources, either because they weren’t properly scheduled or because those scheduled didn’t deliver the necessary support, or both. But this wasn’t due to an energy shortage. There was more than enough generation capacity.”
“Power plants were supposed to help control voltage, and many were paid to do so,” added Aagesen. “Instead, they failed to absorb the required reactive power during high-voltage conditions.”
Renewable energy groups respond
Following the government’s report, several organizations released a joint statement, including Spain’s UNEF (solar association), Portugal’s APREN, SolarPower Europe, the Global Solar Council, and the Global Renewables Alliance:
“Let it be clear: photovoltaic was not the cause of the blackout.
The investigation confirms that managing an electrical system is a complex and multifaceted task of great social importance.
In the future, the Iberian blackout must serve as a learning moment. Photovoltaic already has the ability to control voltage, but regulations have not allowed its application.
This is a call to quickly invest in grid resilience and system flexibility, particularly through grid-forming inverters and battery storage. These technologies are already available and are essential to support stable voltage levels, manage variability, and ensure energy security from renewable sources.
Last year, Spain ranked 14th in Europe in terms of battery installations, with less than 250 MWh of new batteries compared to 9 GW of new solar. Almost all new installations were small-scale batteries, not utility-scale. Even before the blackout, the Spanish market was already responding to this clear need for greater battery storage and flexibility. In 2025, Spain is expected to become one of the top 5 battery markets in Europe, thanks to the recovery of the industrial-scale battery segment. It is now up to the authorities to ensure that the sector is able to provide these services.”