How to Respond to a EU-Level Blackout Cyber Incident

This workshop simulates a cyberattack response to a blackout affecting several European countries. It trains participants in cyber crisis management, stakeholder coordination, and rapid response to prevent escalation into a national emergency. The exercise is dynamic and follows best practices such as NIST SP 800-61 and ISO 27035.

The scenario involves a cyberattack on SCADA systems using a zero-day exploit and ransomware attributed to “DarkGrid,” a fictional state-sponsored actor. Objectives include crisis response, impact mitigation, and drawing lessons learned, all within 90 minutes.

The attack causes cascading outages; by April 29, 99.95% of Spain's power is restored, though disruptions remain. The workshop begins at 13:00 on April 28, 2025—30 minutes after the blackout and initial cyber indicators.

Objectives:

Practice NIST/ISO-based crisis response

Coordinate multi-stakeholder containment

Mitigate secondary impacts

Extract lessons for resilience

Apply insights to future cyber exercises