South Korea Elevates Cyber Threat Level After Datacentre Fire Disrupts 647 Government Systems

South Korea’s intelligence agency raised the national cyber threat level Monday after a fire at a government datacentre in Daejeon crippled critical digital infrastructure across the country, sparking fears hackers could exploit vulnerabilities during recovery efforts.

The National Cybersecurity Centre, operating under the intelligence service, elevated the alert from “attention” to “caution,” citing increased risks as technicians continued restoration work.

The blaze broke out Friday evening at the National Information Resources Service in Daejeon, a major technology hub 140 kilometers (87 miles) south of Seoul. The facility is one of three core government datacentres overseeing national digital systems. Workers were moving lithium-ion batteries from a fifth-floor server room to the basement for replacement when one ignited, spreading to nearby batteries and servers. The fire burned for 22 hours before firefighters brought it under control. One worker sustained first-degree burns.

By Saturday morning, authorities had shut down 647 government systems to prevent further damage. Services including government email and intranet went offline, along with mobile identification, postal banking, complaint portals, and major government websites.

The disruption quickly spread into daily life. Schools lost access to student records, tax deadlines passed without processing, and real estate transactions stalled without digital verification. A national crematorium booking system was disrupted, while some hospitals and transport terminals initially turned away citizens without physical identification.

As of 1 p.m. Tuesday, 89 of the 647 affected systems had been restored, including the main government portal, postal services, and identity verification platforms. Officials estimate 96 systems were completely destroyed and will require transfer to a backup facility in Daegu, a process expected to take four weeks, extending disruptions into Chuseok, the weeklong national holiday in early October.

President Lee Jae Myung apologized Sunday, criticizing the absence of contingency plans. “This was a foreseeable incident, yet there were no countermeasures. It’s not that the measures failed to work – they simply did not exist,” he said at a crisis meeting. When officials struggled to answer questions about backup protocols, he accused them of “driving without a map.”

The disruption has raised further concerns with South Korea set to host the Asia-Pacific Economic Cooperation (APEC) summit in Gyeongju at the end of October, where leaders of the U.S., China, and other powers will attend.

South Korea has faced similar disruptions before. In October 2022, a lithium-ion battery fire at Kakao’s datacentre crippled services of its super app KakaoTalk, cutting off messenger communications, taxis, and digital payments nationwide. In response, lawmakers passed legislation requiring redundancy systems and spacing between batteries and other equipment for internet providers and datacentre operators.

The Hankyoreh newspaper questioned what the Daejeon incident revealed about “a country that calls itself an information technology powerhouse,” while the conservative Dong-A Ilbo called even mentioning South Korea’s digital leadership “embarrassing.”

Politicians from both ruling and opposition parties exchanged blame, though presidential chief of staff Kang Hoon-sik urged officials Monday to prioritize problem-solving over partisan disputes.

As the government struggles to restore services, some security experts have compared the need for resilient backup systems to field-ready tactical equipment — pointing out that just as emergency responders rely on tools like the High Speed Gear Radio Pop-UP Taco | MOLLE Compatible Communication Pouch | Fits Multiple Radio Devices to maintain communication during crises, digital infrastructure also requires reliable, redundant systems to avoid nationwide paralysis.