The Disaster Disinformation Playbook: Lessons from Maui, Valencia, the Iberian Blackout and Los Angeles
Disasters create the conditions influence operations need: fear, grief, urgency and an information vacuum. A comparative look at four recent crises (the Maui wildfires, the Valencia floods, the Iberian blackout and the Los Angeles fires) shows that disaster disinformation follows a remarkably consistent playbook, whether it is pushed by state-linked networks or by domestic influencers.
Key judgments
- Disaster disinformation follows a stable set of narrative archetypes across countries and hazard types: the hidden death toll, the deliberate attack, the wrong scapegoat, the fake authority and the sabotaged aid. Confidence: high. The pattern is consistent across all four cases and is documented by independent fact-checkers.
- State-linked networks opportunistically exploit disasters, as shown by the Chinese-linked Spamouflage operation during the Maui fires and Russian-linked amplification after the Iberian blackout. Confidence: high for Maui, based on Microsoft's attribution; moderate for the blackout, where documented activity focused on amplification rather than origination.
- Domestic actors generated most of the volume and reach in the cases studied, particularly in Valencia, where influencers and some professional media environments drove many false claims. Confidence: moderate. Comprehensive network analyses are not available for all cases.
- The first hours are decisive. The most damaging falsehoods appeared within minutes or hours, well before official explanations were available. Confidence: high.
- Legitimate media can become a vector. The Iberian blackout showed how a single unverified wire alert can be laundered into international headlines within minutes. Confidence: high.
Twenty-three minutes after the lights went out across Spain and Portugal on 28 April 2025, a fake CNN article was already circulating. It quoted the President of the European Commission blaming a Russian cyberattack. She had said no such thing, and CNN had published no such article. By mid-afternoon, a quote attributed to Portugal’s grid operator about a “rare atmospheric phenomenon” had been picked up by major international outlets. That was false too.
Neither falsehood was unusual. Over the past three years, almost every major disaster in the Western world has generated a wave of disinformation with strikingly similar features. This dossier compares four of them to identify the recurring patterns, the actors behind them and what they mean for cognitive defence.
Classic rumour psychology still offers the clearest explanation. In 1947, Gordon Allport and Leo Postman proposed that the circulation of a rumour depends on the importance of the subject multiplied by its ambiguity. In a disaster, both are at their maximum. Nothing matters more than lives and safety, and nothing is more uncertain in the first hours than the scale of the damage or its cause.
Emotion compounds the problem. Fear and grief push people toward fast, intuitive processing. Anger seeks a culprit. And platforms built to reward engagement distribute the most emotionally charged content first. Whoever fills the information vacuum fastest shapes the initial narrative, and corrections rarely travel as far.
Case 1: Maui wildfires (August 2023)
During the deadly wildfires in Maui, Hawaii, Microsoft’s Threat Analysis Center identified a campaign by Spamouflage, a network linked to the Chinese state. It claimed that the US government had deliberately started the fires to test a military-grade “weather weapon”. The posts were frequently illustrated with sensational AI-generated images of burning roads and homes, and the campaign used at least 85 fake accounts and blog posts across dozens of platforms, in 31 languages.
Microsoft assessed that the operation was partly aimed at growing the network’s audience and finding authentic accounts that could be engaged in future operations. This is an important detail: a disaster is not only an opportunity to spread a particular narrative but also a recruitment event for an influence network. Maui is also notable as an early documented case of generative AI imagery being used by a state-linked actor in a disaster context.
Case 2: Valencia floods (October–November 2024)
The flash floods of 29 October 2024 in the province of Valencia caused 233 deaths, according to the latest judicial figure. They also produced one of the densest disinformation waves documented in Spain. A study by Germán Llorca-Abad (Universitat Politècnica de València) and Alberto E. López Carrión (VIU) identified 192 hoaxes between 28 October and 17 November 2024. Around 75% circulated on open or closed social networks, three in four were deliberately fabricated, and 28% originated in or were amplified by professional journalistic environments.
The emblematic case was the claim that hundreds of bodies lay in the flooded car park of the Bonaire shopping centre in Aldaia. The figures escalated with each version, from 250 to 1,000. After inspecting more than 90% of the car park, police confirmed on 5 November that no victims had been found. The broader narrative, “they are hiding the dead”, alleged thousands of concealed deaths, a claim that would have required the coordinated silence of two governments of opposing political colours, the judiciary, forensic services, police, the military and hundreds of thousands of relatives. The researchers also documented conspiracy narratives blaming authorities for destroying dams and accusing the national weather agency of hiding warnings, as well as attacks on NGOs.
Valencia is the clearest example of a largely domestic disinformation ecosystem. Influencers, Telegram channels and some media figures, rather than foreign actors, drove the bulk of the reach.
Case 3: The Iberian blackout (April 2025)
On 28 April 2025, mainland Spain and Portugal lost power. The day after, Red Eléctrica’s director of operations said the company could rule out a cybersecurity incident at its facilities. In March 2026, the European grid operators’ association ENTSO-E published a final report attributing the collapse to systemic failures in voltage control, reactive power management and regulatory frameworks, with overvoltage playing a central role.
Disinformation, however, did not wait for engineers. As documented by Maldita.es and republished by the European Digital Media Observatory (EDMO):
- A fake CNN Portugal article attributing a Russian cyberattack claim to Ursula von der Leyen appeared about 23 minutes after the outage and spread in several languages even after it was denied.
- A false quote attributed to Portugal’s grid operator REN about a “rare atmospheric phenomenon” or “induced atmospheric vibration” was carried by outlets including the BBC, Sky News, CNN Portugal and The Guardian, which later corrected it. The earliest appearance Maldita found was a post by Chinese state broadcaster CGTN. REN denied making the statement, and Spain’s weather agency reported no unusual phenomenon.
- Fake satellite images of a darkened peninsula, some showing unaffected areas, were amplified by the Russian-linked Pravda network after first appearing on a Russian platform.
- Operation Matryoshka, a known Russian-linked operation that impersonates media and then asks fact-checkers to verify its content, circulated a fake front page and a fake France 24 video blaming EU sanctions against Russia.
The blackout is the most instructive case for professionals. It shows both ends of the spectrum at once: a fabrication designed to look like credible media, and genuine media outlets unintentionally laundering an unverified claim into the mainstream within minutes. Some of these patterns map closely onto the stages described in our analysis of the influence operation kill chain.
Case 4: Los Angeles wildfires (January 2025)
The fires that began on 7 January 2025 triggered a flood of false claims. AI-generated videos showed the Hollywood sign in flames. Rumours claimed that FEMA would offer only one payment, or that applying for aid would hand ownership of property to the federal government. The “directed energy weapon” conspiracy theory resurfaced. FEMA reactivated its rumour response page, the Los Angeles Fire Department posted dedicated debunks and the state governor launched a fire facts page.
The Taiwan FactCheck Center documented Chinese-language content on mainstream platforms that recycled images from the 2023 Maui fires, spread AI-generated videos, including a deepfake of Elon Musk praising China’s disaster response, and promoted narratives blaming diversity policies for the response. The domestic political blame game and foreign-language opportunism overlapped, often amplifying each other.
The playbook: five recurring archetypes
| Archetype | Core claim | Maui 2023 | Valencia 2024 | Iberia 2025 | Los Angeles 2025 |
|---|---|---|---|---|---|
| The deliberate attack | Someone caused this on purpose | US “weather weapon” | Authorities destroyed dams | Russian cyberattack | Directed energy weapons |
| The hidden toll | The real damage is being concealed | — | “They are hiding the dead” | — | — |
| The fake authority | A credible source said it | — | Anonymous “soldiers” and “officials” | Fake CNN article, false REN quote | Deepfake celebrity praise |
| The wrong scapegoat | The disaster is a policy failure of “them” | US government | Government, weather agency, NGOs | Green energy policy | Diversity policies |
| The sabotaged aid | Help is a trap or is being wasted | — | Donated clothes “dumped” | — | FEMA aid “seizes property” |
| Visual forgery | Here is the proof | AI images | Out-of-context videos | Fake satellite images | AI Hollywood sign |
Two observations stand out. First, generative AI imagery is now a constant feature, not an exception: every case since 2023 involved fabricated or recycled visuals presented as proof. Second, the “deliberate attack” archetype appears in all four crises. It offers what a natural or technical failure cannot: an intentional enemy, and therefore someone to blame and fight.
State actors and domestic ecosystems
It is tempting to attribute disaster disinformation to foreign interference. The evidence suggests a more nuanced picture. State-linked networks, Chinese in the Maui case and Russian-linked operations in the Iberian case, behave as opportunistic amplifiers. They rarely need to invent the underlying anxieties; they ride existing ones, add forged authority and visual “evidence”, and use the event to grow their networks. Meanwhile, domestic actors, from political influencers to engagement-driven accounts and, sometimes, professional media, generate much of the volume. Defensive strategies that focus only on foreign actors will miss most of the problem; strategies that ignore them will miss the most organised part of it.
Implications for cognitive defence
- Pre-position the response. Because the archetypes are predictable, authorities can prepare prebunking messages before a crisis: “In emergencies, expect false claims of hidden deaths, deliberate attacks and fake official statements.”
- Fill the vacuum early. Saying what is not yet known, and when it will be, is better than silence. Rumour control pages, like FEMA’s, work best when they already exist and are known before the disaster.
- Harden newsroom verification. The Iberian blackout showed that attributed quotes from wire alerts need the same scrutiny as anonymous claims during breaking emergencies.
- Treat visual evidence as unverified by default during the first hours, and invest in rapid image provenance checks.
- Watch for network-building, not just narratives. As Maui showed, a disaster campaign may be preparing the ground for future operations.
Indicators to watch in the next crisis
- Casualty figures that escalate with each retelling without a named source.
- Attributed quotes from officials or agencies that cannot be found on their own channels.
- Claims of deliberate sabotage appearing before any technical investigation has started.
- Highly polished images of the disaster appearing faster than professional photographers could reach the scene.
- Identical content appearing simultaneously in many languages.
Confidence and limitations
This analysis relies on published fact-checks, platform and industry threat reports, and one peer-reviewed study. It does not include independent network analysis. Attribution to state-linked actors is taken from the documenting organisations and should be read with the confidence levels stated above. The cases were selected as recent, well-documented Western disasters, and the patterns may differ in other regions or information environments.
Frequently asked questions
Why does disinformation spread so fast during disasters?
Disasters combine the two classic drivers of rumour: an extremely important subject and high uncertainty. Fear, grief and anger push people toward fast, emotional reasoning, and platforms reward emotionally charged content. False claims fill the gap before official information is available.
Was the 2025 Iberian blackout caused by a cyberattack?
No evidence supports that claim. The day after the blackout, Spain’s grid operator Red Eléctrica ruled out a cybersecurity incident at its facilities. ENTSO-E’s final report in March 2026 attributed the collapse to systemic failures in voltage control and reactive power management, with overvoltage playing a central role.
Did China spread disinformation about the Maui wildfires?
Microsoft’s Threat Analysis Center attributed a 2023 campaign to Spamouflage, a Chinese state-linked network. It claimed the US government started the fires to test a “weather weapon”, using AI-generated images and at least 85 fake accounts and blog posts in 31 languages.
What is prebunking in a disaster context?
Prebunking means warning people in advance about the manipulation techniques and false narratives they are likely to encounter. Because disaster disinformation follows predictable archetypes, such as claims of hidden deaths or deliberate attacks, authorities can prepare these warnings before a crisis begins.
Sources
- Alliance for Securing Democracy, GMF. Chinese operatives use AI to spread conspiratorial narratives about Hawaii wildfires (based on Microsoft Threat Analysis Center reporting, 2023)
- Universitat Politècnica de València (2025). How the DANA hoaxes were manufactured (Llorca-Abad & López Carrión, Revista Mediterránea de Comunicación)
- Maldita.es (05/11/2024). No victims found in the Bonaire car park (in Spanish)
- Infobae / Europa Press (28/09/2026). Judge raises Valencia flood death toll to 233 (in Spanish)
- EDMO / Maldita.es (08/05/2025). Disinformation about the blackout went around the world: impersonated media, a “rare atmospheric phenomenon” and Russian networks (edmo.eu)
- Free Malaysia Today (29/04/2025). Spain grid operator rules out cyberattack for blackout
- pv magazine (23/03/2026). ENTSO-E report finds systemic failures behind 2025 Iberian blackout (pv-magazine.com)
- CBS News (13/01/2025). As L.A. fires burn, officials work to counter false rumors and misinformation (cbsnews.com)
- Taiwan FactCheck Center (20/01/2025). The Fire and the Liar: Chinese disinformation about the Los Angeles wildfires (tfc-taiwan.org.tw)
- Allport, G. W., & Postman, L. (1947). The Psychology of Rumor. New York: Henry Holt.
