Cybersecurity

Iberian Peninsula Blackout: The IT Impact On April 28, 2025, a large-scale blackout affected Spain, Portugal, and part of southern France, causing severe disruptions to IT and digital systems. Impacts on IT and Digital Systems Communication network outages: mobile networks and the internet experienced major interruptions, making communication and access to information difficult. Suspension of banking and payment services: ATMs and electronic payment systems were disabled, preventing financial transactions and access to cash. Transport disruptions: rail and metro lines, including the Madrid metro, were evacuated due to power outages, blocking control and safety systems. Hospital service interruptions: hospitals had to rely on emergency generators to keep critical systems running, such as intensive care and diagnostic equipment. From the staff at Delphi Studio, an IT company in Valencia, we received reports of a power outage lasting about 12 hours. However, after power was restored, everything returned to normal and servers are operational again to continue Delphi code development. Cause Investigations Spanish and Portuguese authorities launched investigations to determine the blackout’s causes. The National Institute for Cybersecurity (Incibe) is assessing the possibility of a cyberattack, although early analyses suggest a technical issue or cable fault as the main cause. Portuguese energy company REN pointed to a rare atmospheric phenomenon called “induced atmospheric vibration” as a possible origin of the outage. Service Restoration By the evening of April 28, power was restored in many areas, with 99% of energy demand met in Spain and most substations operational in Portugal. However, the disruptions to IT and digital systems highlighted the vulnerability of critical infrastructure during prolonged power outages. This event underscores the importance of strengthening the resilience of IT systems and communication networks by implementing security measures and emergency plans to ensure continuity of essential services during crises.

Serious security breach in the Polyfill.io project: over 100,000 websites compromised. A serious supply chain attack was recently discovered involving the Polyfill.io service, used by thousands of websites to ensure compatibility with older browsers. The attack affected over 100,000 sites, raising significant concerns about online security and trust in third-party libraries. The Polyfill.io Breach Polyfill.io provides “polyfills,” pieces of JavaScript code that implement modern functionalities in older browsers. This service was compromised after the domain management was transferred to the Chinese company Funnull in February 2024. Shortly thereafter, the code distributed through Polyfill.io began to contain malicious scripts, primarily targeting mobile devices, which redirected users to sports betting sites and adult content. The Response from the Tech Community The attack raised immediate concerns among security experts and web infrastructure providers. Cloudflare and Fastly quickly implemented secure versions of the Polyfill service to mitigate the risks. Additionally, Google began notifying its advertisers about the potential risks related to sites that loaded code from Polyfill.io, blocking ads on these compromised sites. Recommendations for Webmasters Security experts strongly recommend immediately removing any references to Polyfill.io from websites. In addition, it is advised to adopt security measures such as: Implementing a Content Security Policy (CSP): to restrict the sources from which scripts can be loaded. Using Subresource Integrity (SRI): to verify that the resources downloaded have not been tampered with. Regularly Monitoring Dependencies: performing periodic security audits to detect any abnormal behavior. The Polyfill.io incident is a clear example of the risks associated with using third-party libraries and highlights the importance of adopting robust security practices to protect web infrastructure. Companies must remain vigilant, regularly update their dependencies, and follow best practices for security.