Lisbon, Portugal – An investigation suggests that the initial social media posts claiming a Russian cyberattack caused the April 28 power outage across the Iberian Peninsula may have originated in Portugal. The blackout, which plunged parts of Portugal and Spain into darkness, sparked a flurry of speculation and accusations online.

The Investigation’s Findings

Researchers at ISCTE Medialab, in partnership with the National Elections Commission (CNE), released a report on Wednesday that monitored disinformation during the campaign for the May 18 legislative elections. The report specifically addressed the widespread power outage and the theories surrounding its cause.

The researchers emphasized that the absence of effective institutional interaction in the early hours contributed to an informative vacuum. This vacuum, they argue, allowed theories, including the one attributing the blackout to a Russian cyberattack, to proliferate rapidly.

Timeline of disinformation

• 11:50 a.m. (Local Time): Approximately 20 minutes after the blackout began, the narrative of a Russian cyberattack started circulating on Portuguese social networks.
• Content of Initial Posts: These posts allegedly reproduced news from CNN International, attributing statements to European Commission President Ursula Von Der Leyen.
• Origin: While the exact origin remains uncertain, the Medialab researchers’ analysis indicates that the initial spread likely occurred in Portugal, with a Portuguese version serving as the basis for subsequent translations, including Russian.
• 1:55 p.m. (Local Time): Russian media outlets, such as BFM, began publishing ambiguous reports that mixed factual elements with unsubstantiated rumors, suggesting a coordinated attack and transnational sabotage.

amplification and Reach

The report indicates that the disinformation was rapidly amplified on WhatsApp and Telegram channels associated with pro-Russian groups, reaching tens of thousands of views within the first few hours.

In the days following the blackout, pro-Russian cyber groups claimed duty for the alleged attack, citing purported evidence of distributed denial-of-service (DDoS) attacks.

However, the report notes, consulted cybersecurity experts have ruled out any relationship with the blackout, stressing that these groups do not have the operational capacity to cause electric infrastructure failures. The researchers concluded that these groups exploited the blackout to gain media attention.

alternative Theories and Ideological Spins

Beyond the cyberattack narrative, other theories emerged to explain the power outage, the cause of which remains unknown. Some of these theories carried an ideological slant favorable to Russia.

• NATO “Resilience Test”: Some Telegram posts suggested the blackout was a “resilience test” conducted by NATO or a social engineering operation to justify future military escalation.
• Energy Policy Blame: Other theories linked the energy failure to environmental policies promoting energy transition, sanctions against Russia, and the degradation of European infrastructure.

The report highlighted that some of these messages showed signs of automatic translation or where created using artificial intelligence.

Social Media Distribution

The majority of publications related to the blackout were shared on X (58.21%) and Facebook (33.68%), followed by Instagram (6.03%), TikTok, and Reddit (both 1.04%).

Media accounts, utilizing X’s intelligence engine to answer user questions about the various narratives, were the most active in publishing and deconstructing disinformation related to the blackout.

Belief vs. Fact

The report found that while the overwhelming majority of publications (81%) were considered neutral, those that appeared to believe or propagate the disinformation narratives outnumbered those that denied them (12% vs. 6%). Furthermore, the disinformation reached a significantly larger audience than the fact-checking efforts.

Ongoing Monitoring

The National Elections Commission (CNE) and ISCTE’s Medialab, in partnership with Lusa, are continuing to monitor social networks to identify and measure the impact of misinformation on the May legislative campaign, extending until May 24.

Medialab produces weekly reports on the disinformation phenomenon.