North Korea's Internet Disruption Hits 42 Websites and Email Services

State websites struggle to return after widespread outage

North Korea's main news websites, Foreign Ministry pages and an email server suffered repeated connection failures after a disruption began at about 11 a.m. Korean time on October 20, 2026. By the afternoon of October 21, 42 websites using the country's .kp domain were inaccessible or unstable, leaving people abroad struggling to reach official information.

Monitoring service Pingdom recorded the Korean Central News Agency website as unavailable for 19 of the first 24 hours after the trouble began. That amounts to about 79% of the period. Other websites had even shorter windows of access, with roughly 10 minutes of availability recorded during the morning of October 21.

The disruption affected organisations with different functions at almost the same time. Alongside the Korean Central News Agency, or KCNA, the affected services included the Rodong Sinmun and Minju Joson newspapers, the international broadcaster Voice of Korea, the Naenara information portal and state airline Air Koryo. The DPRK portal, which lists official North Korean websites, also became unreachable.

North Korea's Silibank SMTP email server stopped responding at about the same time. SMTP is the system servers use to pass email between them. Its failure extended the disruption beyond reading news or opening government pages to a service used for electronic correspondence.

The broad pattern has focused attention on infrastructure shared by these services, including international connections, equipment and the systems that direct browsers to website addresses. Short periods of restored access were followed by further failures, making recovery uneven rather than a single return to normal.

How the disruption unfolded

South Korea's Unification Ministry was cited in accounts describing an initial interruption of about eight hours on October 20, followed by an apparent recovery around 8 p.m. Those approximate descriptions leave some uncertainty about the first recovery time. Connections failed again around 11 p.m., and the trouble continued the next day.

The main sequence, with times in Korea, was:

• October 19: North Korean state media said Kim Jong Un visited a clothing and footwear exhibition in Pyongyang with his wife, Ri Sol Ju, and daughter, Ju Ae.
• October 20, about 11 a.m.: Several official websites and the Silibank email server became unreachable at roughly the same time.
• October 20, around 8 p.m.: Major websites appeared briefly to recover after an initial interruption described as lasting about eight hours.
• October 20, around 11 p.m.: Connection failures returned.
• October 21, morning: Other affected websites had only about 10 minutes of recorded access, while the email server was reachable for about five minutes.
• October 21, afternoon: Widespread failures continued, despite intermittent access from about 11:30 a.m.

Some connections dropped every one or two minutes even when pages could initially be reached. Access problems were observed from South Korea and the United States, placing the disruption beyond a single country's connection to North Korea.

By October 22, the disruption was described as entering a third calendar day. The most detailed measurements concerned October 20 and 21, including continued failures at 1 p.m. on October 21. Brief access during that period gave users only narrow opportunities to retrieve information.

Address servers offer a technical clue

Security companies in South Korea examined public routing information and the Domain Name System, known as DNS, to track the repeated failures. Routing information describes the paths internet traffic can take between networks. DNS translates a website name into the numerical internet address a computer needs to contact it.

Their analysis found that servers responsible for the top level .kp domain were responding, while lower level name servers handling individual website addresses were not. In simple terms, the first part of the address lookup could work, while a later step needed to find a particular website failed.

A visitor can therefore encounter an unavailable page even when part of the wider address system is still operating. A failure in infrastructure used by many websites can make different organisations disappear from view together.

The combination of DNS trouble, repeated reconnections and an affected email server makes shared infrastructure a central part of the investigation. The concrete effect for users was straightforward: knowing the correct website address was often insufficient to reach the service.

China and Russia provide routes to the outside world

North Korea's external internet connections have long relied on a limited set of routes. Its Ryugyong-dong network has used connectivity supplied by China's China Unicom and internet addresses associated with Cenbong, a network operator based in Hong Kong.

Russia's TransTeleCom has served as an alternative internet provider since 2017. Since 2023, traffic supplied through China and Russia has also passed through a supplementary network based in the Philippines that supports the Ryugyong-dong network.

Alternative routes give traffic more than one possible path. Their usefulness, however, depends on the equipment and services along those paths. Several routes can still depend on a common device, power supply or address server before a user reaches a website.

The prolonged disruption despite those alternatives makes the location of the failure especially relevant. A problem affecting a shared part of the system could reach websites belonging to newspapers, a ministry and an airline at once. The observed pattern has drawn attention to the Ryugyong-dong network and the infrastructure connecting it to foreign providers.

Power failures, maintenance and attacks are possible causes

North Korean authorities had issued no explanation for the outage or timetable for full restoration. The cause remained unresolved: possibilities included a faulty connection, equipment trouble, unstable electricity, maintenance or an external attack. No attacker had publicly claimed responsibility, and South Korean authorities said they lacked information confirming a cyberattack.

Park Chan-am, chief executive of South Korean cybersecurity company Stealien, pointed to power supplies as a possible explanation for the repeated loss and return of service. He said unstable electricity could cause routers at the border or switching equipment to turn off and on intermittently.

Routers direct data between networks, while switching equipment moves it between connected devices. When such equipment loses power, many services can become unreachable together. Once electricity returns, connections may briefly resume before another interruption.

Park also said an outage in June of the previous year had been assessed as an internal problem rather than an external attack. His explanation of the current pattern centres on equipment operation and the electricity needed to keep it running.

Maintenance is another possibility, particularly work involving traffic arriving through China. North Korea has previously left websites unavailable for extended periods while reorganising its online presence. The length of this interruption, however, was longer than would generally be expected for routine maintenance.

Why a traffic surge and a DDoS attack are different

A sudden increase in genuine visitors can overwhelm a website. A distributed denial of service attack, usually called DDoS, deliberately floods a server or connection with traffic from many sources so ordinary users cannot get through. Both can produce slow pages, failed connections and periods of complete unavailability.

Security companies raised the possibility that an attack targeted infrastructure used to manage website addresses or a connection shared by multiple services. An attack at that level could affect many websites simultaneously, rather than just one news page.

Interest in Kim Jong Un's whereabouts also prompted suggestions that unusually large numbers of people were trying to reach North Korean news sites. Some may have been looking for reports or photographs of his exhibition visit.

The affected services extended well beyond news, however. The Foreign Ministry, Air Koryo, information portals and an email server all experienced trouble. That wider reach places greater attention on infrastructure common to several services than on demand for a particular news story.

Rumours spread while official pages were hard to reach

Unsubstantiated claims that Kim Jong Un had died circulated on overseas social media around the time of the outage. The claims included a story that he had suffered a brain haemorrhage and been taken to a hospital in Beijing. South Korean foreign affairs and security authorities were reported to have found no information supporting the story.

North Korean state media, meanwhile, published photographs and accounts of Kim visiting a clothing and footwear exhibition in Pyongyang on October 19 with Ri Sol Ju and Ju Ae. Those reports gave readers a specific account of his public activity as the online rumours spread.

KCNA continued distributing news through its wire service during the website failures. That allowed official reporting to reach recipients through another channel, even while public web pages were inaccessible. Continued transmission also made an intentional shutdown designed to stop all outward publication a less likely explanation.

For readers abroad, the practical difficulty was that the normal places to check North Korean statements were frequently unavailable. News production and website access were operating differently: material could still be transmitted while the public pages used to read it remained out of reach.

Earlier outages show several ways services can fail

North Korea experienced another major internet interruption in late 2014, following the Sony Pictures hacking controversy surrounding the film The Interview, which depicted an assassination plot against Kim Jong Un. A detailed account describes websites being unreachable for about 10 hours during an attack attributed to unidentified activist hackers; broader descriptions refer to disruption extending over several days.

In early 2022, American hacker Alejandro Caceres, known online as P4x, carried out DDoS attacks that disrupted North Korean websites and email services. Those attacks provide a specific precedent for an outside actor affecting more than web pages alone.

Park's account of the following June outage points to a different failure mechanism: internal operational trouble. Taken together, these episodes show why identifying the affected equipment, traffic pattern and power conditions matters when determining how service was interrupted.

The immediate impact of the October disruption was concentrated on North Korea's public internet presence. Foreign readers lost reliable access to official news, government information and airline pages, while the email interruption affected another route for communication. Continued wire transmissions preserved a separate outlet for state reporting, but public access remained intermittent.

Key Points

• The disruption began around 11 a.m. Korean time on October 20, 2026, and affected 42 websites using North Korea's .kp domain.
• Pingdom recorded KCNA's website as unavailable for 19 of the first 24 hours, about 79% of that period.
• The Silibank email server also failed, with only about five minutes of access recorded on the morning of October 21.
• Security analysis found responding top level .kp servers but failures among servers handling individual website addresses.
• Possible causes included connection or equipment faults, power interruptions, maintenance and DDoS attacks.
• KCNA continued transmitting news through its wire service while public websites were difficult to reach.
• North Korea had provided no official cause or timetable for full restoration.