April 28, 2025: Blackout in Spain and Portugal
Power failures, fires, sabotage: companies will have to plan for the worst
Les Echos, May 7, 2025
This week, the French National Assembly begins examining the resilience bill, which will require many “vital” economic sectors to better anticipate extreme risks. One week after the giant Spanish blackout, the vulnerability of businesses is back on the agenda.
Transport at a standstill, digital payments and telecommunications down, food inventories going bad, drinking water cut off in some towns. The Spanish blackout a week ago showed just how vulnerable businesses can be.
The catastrophe didn’t last long enough to turn into a tragedy, but the wake-up call was severe. “The Spanish crisis is a timely reminder to companies of the extent to which risks are multiplying beyond cyberattacks”, points out Philippe Latombe, Modem deputy for the 1st constituency of Vendée. This Wednesday, the special commission he chairs will tackle the bill on the resilience of critical infrastructures and the reinforcement of cybersecurity.
This new bill, already voted in March by the French Senate, is the French transcription of three European directives (REC, Dora and NIS 2) which have been brought together in a single bill, given the similarity of issues regarding anticipating risks. It’s another step forward for companies.
Since 2006, some 300 operators of vital importance (OIV) in a dozen sectors have been required to have a protection plan for the 1,500 sensitive sites (factories, government offices, data centers, etc.) they manage. The new regulations will add several new sectors to this list, such as heating network operators, the hydrogen industry and wastewater treatment plants.
It also shifts the focus from site protection to a strategy of resilience in the face of extreme events. “Threats have become so numerous, and computer attacks so regular, that the issue is not to preserve sites, but to maintain vital services as much as possible,” explains Olivier Cadic, the centrist senator who chairs the Upper House’s special commission. “Previously, we would ask a hospital to deploy firewalls around its IT systems. Now we’re going to require them to relearn how to work with paper and pencil”, illustrates Philippe Latombe.
Finally, the bill introduces penalties for failure to prepare properly, with amounts of up to 10 million euros or 2% of annual worldwide sales, plus 5,000 euros for each day of non-compliance. This measure is intended to replace the criminal penalty system in force until now, which has never been applied. A consequence that does not frighten large companies and their risk managers, represented at the Association pour le management des risques et des assurances de l’entreprise (Amrae). Philippe Cotelle, co-chairman of Amrae’s cyber commission and risk manager at Airbus Defence & Space, anticipates that “the bill should be the subject of a consensus. In Europe, we need to wake up and realize that companies are under threat.”
All the experts still have in mind some spectacular examples of major failures of sensitive operators. In 2018, several Paris train stations were paralyzed in the middle of the vacation season when a power station caught fire. Last summer, just before the Paris Olympics, several small-scale sabotages attributed to far-left groups were enough to halt TGV traffic. Another case in point is the OVH data farm in Strasbourg, which went up in smoke, along with the sensitive data of many companies.
Abroad, we’re reminded of the megafires in California, the floods in Valencia, Spain, and the cutting of submarine cables in the Baltic.
Pandemic risk slowly declining
For Clotilde Marchetti, who heads up the extreme risks practice at Grant Thornton France, it takes events such as these for companies to put the subject at the top of the priority list. The day after the Spanish blackout, she explained to Les Echos: “I think that the subject of power failures is going to move back up the Top 5 of major risks in all risk maps. Just as the pandemic, which had become a non-issue since the avian flu in 2009, rose right after Covid and is now slowly creeping back down the list.”
The bill, whose final vote is not expected before the end of the year, should give a boost to companies’ risk culture. Especially as “80% of problems are generally human errors”, says Olivier Cadic. He cites the recent case of a large organization that was hacked because a computer network manager let his password leak. A rookie mistake that paralyzed the system for a fortnight.
For the parliamentarians, arms manufacturers are the most mature on the subject, given the threats they face (espionage, sabotage) and the sensitive nature of their activities. But even this sector needs to make progress. “EDF does a good job of anticipating environmental risks, such as the need to shut down power plants in the event of extreme heat and water shortages, because this is the core of their business. But is Safran’s Montluçon site, which equips drones, well prepared for forest fires?” asks deputy Philippe Latombe.
For companies, these new obligations risk appearing as yet another constraint. That’s why Clara Chappaz, the French Minister for the Digital Economy, has opposed the attempt by some members of parliament to extend companies’ obligations to their suppliers. Anticipating the criticism, Senator Olivier Cadic also dismisses out of hand the subject of additional costs for companies: “It is out of all proportion to the damage suffered in the event of an attack.” At Amrae, Michel Josset, also director of insurance-prevention at equipment manufacturer Forvia, points out that CAC 40 risk teams are limited to a handful of employees. So there’s an extra human cost involved. As for the financial equation, it’s a complex one. Between the cost of insurance, the cost of uninsurable risks, and the cost of protection and resilience investments, companies are navigating a fine line,” adds Michel Josset.
Giant breakdown in Spain: what lessons for card and mobile payments?
Les Echos, May 2, 2025
The recent power failure in Spain cruelly revealed the limits of card and mobile payments – a textbook case that will be carefully dissected by payment specialists in France.
How to pay by card when payment terminals are out of battery? How do you pay cash when ATMs are down? What use is mobile payment if the network is down? The experience of the giant blackout in Spain and Portugal on April 28 immediately raised a number of questions. An incident that left payment specialists in France in a cold sweat.
The Cartes Bancaires national network in France has indicated that it is analyzing the consequences of the event on payments, commerce and ATMs. Its experts are studying the measures taken by Spain and Portugal, as well as those that would be necessary in France in a similar situation. The national network has an offline model to limit the impact of this kind of situation, and organizes crisis exercises involving all the relevant parties around once a year.
”We asked our members with stores in Spain and Portugal for feedback, because we’ve never had to deal with this kind of phenomenon,” explains Charlotte Pagot, General Secretary of Mercatel, an organization representing retailers. We have regular discussions to see how to turn around in the event of a crisis, but this experience will certainly fuel them.”
Card payments refused
In Spain, according to the daily newspaper El Pais, the only stores that remained open were mostly cash-only, as not all card networks were operating. Sabadell and Santander payment terminals (TPE) were able to accept payments normally, as the servers to which they are connected had back-up generators. However, the merchants’ terminals still needed to have battery power, given that the outage lasted more than ten hours in some places.
Payments via the Spanish instant payment system Bizum were interrupted several times. To get around, people had to abandon Uber, which no longer had a network, and rush to cabs, which were the only ones able to accept cash. But many cash dispensers were also out of order due to a lack of electricity. And banks were forced to close some of their branches.
The Bank of Spain contacted banking institutions the very same day to monitor the situation. The local Redsys card network, the equivalent of Cartes Bancaires in France, also remained operational, according to “El Pais”. As did SIBS, the Portuguese payment network. Some stores were able to use emergency [diesel] generators to power their Eftpos terminals and authorize card payments.
Argument for cash
Local card networks have a key role to play in this kind of situation,” says Andrea Toucinho, Director of Studies, Forecasting and Training at Partelya. The Portuguese SIBS network is a highly centralized system, present across the entire payment value chain, from cards to mobile and Internet payments. The advantage is that if SIBS comes up with solutions to alleviate a crisis situation, there is a guaranteed minimum service, as all banks are connected to this network.
In Portugal, however, the consumer association DECO, the equivalent of France’s UFC-Que Choisir, was quick to reaffirm the importance of systematically accepting cash as a means of payment “in all physical transactions”. “The increasing digitization of payments must take place alongside cash, never in place of it”, she insisted, stressing the importance of maintaining and optimizing ATMs.
This is an argument shared by Mercatel in France and regularly stressed by the Banque de France. In fact, the supply of banknotes to ATMs and retailers is regularly subject to crisis scenarios. This was the case last year during the Olympic Games in Paris, in order to be able to deal with a possible problem with the payment system, and again in 2016 with a scenario involving flooding on the Seine. Due to fears of a Russian cyber attack, the Nordic countries have already urged their citizens not to abandon cash payments.
For its part, the independent operator Loomis, which supplies and feeds ATMs, was quick to add its voice to the chorus. “While digital payments are extremely convenient and have many advantages, scenarios that make them unavailable are an important reminder of the resilience and reliability that bills and coins provide,” it argues.
A chance for the digital euro?
Andrea Toucinho believes that offline payment, which is one of the planned use cases for the digital retail euro, would also be highly advantageous in this type of situation, adding that the most important thing is to offer a diversified range of payment methods. “Perhaps we should also encourage the payment ecosystem to think about solutions that can be accessed even in exceptional situations,” she adds. Because without a battery, it’s hard to use your phone to pay in digital euros.
Telecoms revenue in the event of a blackout
Les Echos, April 30, 2025
When a power grid goes down, telecoms follow by domino effect. Impossible to send text messages, no dial tone when making a call, no Internet connection… This blackout is reminiscent of what the Mahorais experienced in December after the passage of cyclone Chido [by December 15, 2024, 51 of Orange’s 54 mobile network antennas had gone out of service]. Power cuts, though rare, have led French operators to arm themselves in case of crisis.
Why do networks go down?
In Mayotte, the first reflex was to turn to the operators for an update on the restoration of their mobile antennas. And the answer was often the same: “We’ve restored part of our network, but the electricity hasn’t been restored.” According to the French telecoms regulator (Arcep), a 4G antenna consumes up to 7 kilowatts (kW), and its 5G equivalent, up to 19 kW. In the case of fiber optics, the light wires consume nothing. It’s the equipment at the ends that requires electricity. On the user side: the modem and all related equipment, such as a computer or TV set. On the operator side: the backbone network (the highway that transports data via energy-hungry servers and network equipment), and the secondary axes that send Internet to the regional level.
Energy consumption for infrastructures rose again in 2023, according to the latest Arcep measurement (+6%). At the same time, the transition from ADSL to fiber has led to a marked drop in consumption by fixed networks (-14%). Both networks consumed 4.1 TWh (+2%), to which must be added 3.5 TWh for modems and TV set-top boxes.
Which solutions?
Antennas are usually equipped with a battery, providing between thirty minutes and two hours of autonomy. This is not enough to cope with a blackout like the one experienced in Spain, where electricity took several hours to be restored, but it does enable emergency communications.
Batteries are also used for network cores. The real resilience, however, comes from diesel generators. For the network core, batteries are activated first in the event of an outage, waiting for the generator engine to start up,” says Christian Gacon, Director of Broadband Networks at Orange France. It’s important to maintain a core network, because it’s not enough to restore power in order to restart the Internet; it takes several hours to reconstitute the network architecture.”
At a more local level, Optrical Line Termination operators are not always backed up by these generators, which would leave some in France without Internet in the event of a blackout. Only critical services (hospitals, police, gendarmerie and government ministries) are guaranteed a connection, including a mobile one: some critical antennas can benefit from generators.
“We thought about network resilience by burying the fiber, but we forgot that everything depended on electricity alone, and we really need diesel generators,” says the head of one telecom operator.
Have we learned from past crises?
When the French power grid faced the risk of load shedding in winter 2022, due to technical problems at nuclear power plants, telecom operators worked closely with grid operator Enedis.
This enabled them to check processes, run simulations and test generators, which are costly to maintain and “may not start up when we need them”, confides one operator. The Ciaran storm, which brought down equipment in western France at the end of 2023, made telecom operators aware of the importance of close dialogue with the grid operator. This was confirmed in Mayotte, when Electricité de Mayotte was helped by telecoms to recover a picture of its network in order to restore power, after losing its servers.
In the event of a power cut, inter-operator solidarity is set up to share data. A “red telephone” is also planned with the Commissariat aux communications électroniques de défense (attached to the Prime Minister), prefectures and Enedis.
And Starlink?
Elon Musk’s constellation was used in Mayotte to quickly re-establish a connection, but using… generators. This provoked the ire of operators, who were deprioritized.
Orange’s “safety cases”, which provide a wi-fi bubble, are equipped with Starlink antennas. But this equipment consumes a lot of energy. In the event of a widespread power cut, they are no panacea.
In the face of threats, the Nordic countries are working on a offline card payment system
Les Echos, May 7, 2025
In a geopolitical context complicated by the war in Ukraine, Finland, Sweden, Norway, Denmark and Estonia want to have a backup plan for payments should Internet connections be cut. In France, Cartes Bancaires already has an offline model.
After recommending that their citizens keep cash at home, the northern countries are now looking for a plan to enable offline card payments, should Internet connections be cut. Tuomas Valimaki, a member of the board of the Bank of Finland, told Reuters on Wednesday that Finland, Sweden, Norway, Denmark and Estonia were considering setting up an offline card payment system to provide a back-up solution in the event of a network outage.
For these countries, the challenge is to cope with the threat of a large-scale cyber attack or sabotage of submarine cables by Russia as part of pressures linked to the war in Ukraine. This could potentially paralyze payment systems, causing chaos and forcing stores to close.
Storing transaction data
Indeed, according to the latest data from the European Central Bank, card and mobile payments account for 57% of in-store payments in Estonia and 67% of payments in Finland. And only 10% of Finns use cash as their main means of payment, according to the Bank of Finland. The country is set to enable offline payments as early as next year.
“As card payments require functioning international data links, Finland must be prepared for interruptions. Many other countries are, of course, in the same situation,” said Tuomas Valimaki, adding that Norway, Sweden, Denmark and Estonia were also planning to introduce offline card payments, and perhaps other countries as well. He said that plans were still being drawn up, but in concrete terms this could mean, for example, using payment terminals to encrypt and store transaction data until the Internet connection is re-established.
Finland would also like to be less dependent on the major American card networks Visa and MasterCard, or e-wallets such as Apple Pay, and plans to introduce a national instant transfer payment system within a few years, he explained.
The Central Bank of Sweden, meanwhile, told Reuters that it hopes to establish a system by July 1, 2026 that will allow Swedes to make offline card payments for essential purchases, in the event of disruptions that could last up to seven days.
CB already has an offline model
The Nordic countries are not alone in exploring offline payment plans, and such initiatives are likely to multiply in the face of the variety of threats facing Europe today, be they industrial, geopolitical or climatic.
Last week’s giant power cut in Spain has also rekindled concerns. In France, the national Cartes Bancaires network already has an offline model that enables it to continue processing payments at merchants in the event of system breakdowns or Internet connection failures.
But the crisis scenario will now be tested across the entire payment chain, from merchants to banks, in coordination with public authorities, cash-in-transit operators, the regulator, etc. And CB will be taking advantage of the Spanish experience to test energy disruption scenarios, in order to reinforce the locations requiring backup generators.
via: sansnom
Translated by Act for freedom now!