Kim Jong Un Death Rumors, Then 42 Websites Went Down: Was North Korea Offline for 32 Hours? (Part 2)

At around 11 a.m. on October 20, 2026, websites operated by North Korean government agencies and state media outlets began going offline.

The foreign ministry, the Korean Central News Agency (KCNA), and the ruling party newspaper Rodong Sinmun were among the affected services. South Korean reporters identified 42 major North Korean websites that were inaccessible or unstable.

The timing was almost too convenient for a Cold War thriller. Rumors about Kim Jong Un’s death had begun circulating internationally just the day before. Then, as people looked for information, dozens of North Korea’s official websites became difficult to reach.

But I became interested in a different detail: the claim that the outage lasted 32 hours.

The websites were not continuously offline for 32 hours. And although a US network-monitoring firm’s findings pointed toward a cyberattack, they did not identify the attackers or establish any connection to the death rumors.

So what actually happened to North Korea’s internet connections, and what do the numbers tell us?

AI-generated conceptual illustration of intermittent access problems affecting North Korea’s publicly accessible websites. It does not depict an actual monitoring room, personnel, or error screens.

Were North Korean Websites Really Down for 32 Hours?

Reports published by South Korea’s Yonhap News Agency on October 21 and 22 provided a more detailed account than the headline alone suggested.

I reconstructed the reported sequence of disruptions and recoveries below. All times are Korea Standard Time (KST, UTC+9), which is also Japan’s time zone.

Date and time (KST)	Reported connection status
Oct. 20, around 11 a.m.	Multiple websites become inaccessible or unstable
Oct. 20, around 7–8 p.m.	Temporary recovery after roughly eight hours of disruption
Oct. 20, around 11 p.m.	Another round of connection failures begins
Oct. 21, daytime	Repeated outages interrupted by brief periods of access
Oct. 21, around 7 p.m.	Connections appear to stabilize
Oct. 22, 5:30 p.m.	Stable access to the 42 monitored websites is confirmed

The arithmetic is straightforward. From 11 a.m. on October 20 to 7 p.m. on October 21 is 24 hours plus another eight hours, making approximately 32 hours.

But the period was not one uninterrupted blackout.

Yonhap reported that normal access was observed on 11 occasions on October 21, with individual periods lasting approximately one to 18 minutes.

That detail changes the meaning of the headline.

The 32 hours describe the elapsed time between the initial disruption and sustained recovery. They do not establish that all 42 websites were continuously unavailable for the entire period.

Nor can we calculate the exact cumulative downtime of each website from those reports. To do that, we would need complete, site-by-site monitoring records with consistent sampling intervals.

This matters because a 32-hour period containing intermittent recovery is a different technical event from a verified 32-hour continuous outage.

Why Was Unusual Traffic Coming from Vietnam, the Philippines and Venezuela?

On October 23, Reuters reported the findings of Kentik, a US company specializing in internet traffic monitoring.

Doug Madory, Kentik’s director of internet analysis, said that unusually large volumes of traffic directed toward North Korea had been observed around the time the outages began, at approximately 11 a.m. on October 20.

The traffic included waves originating from locations such as Vietnam, the Philippines and Venezuela.

That pattern was consistent with a distributed denial-of-service (DDoS) attack, in which traffic from many systems overwhelms a service or network connection and makes it difficult for legitimate users to connect.

Madory’s assessment strongly supported the presence of DDoS traffic. However, Kentik analyzed only part of the traffic reaching North Korea, and the available data did not establish who was responsible.

There is an important distinction here.

Traffic originating from Vietnam is not evidence that the Vietnamese government ordered an attack.

Attackers can use compromised computers, servers, and other devices located far from where they themselves operate. The apparent source of network traffic does not necessarily identify the person or organization controlling it.

Before Kentik’s analysis was reported, possible explanations included power instability, failures in communications equipment, and problems affecting shared international connections.

The DDoS evidence made a deliberate traffic-flooding attack a much more substantial explanation. It did not demonstrate that every affected device had the same cause of failure, or reveal the identity or motives of the attacker.

Forty-Two Websites Went Down. Did the North Korean State Go Down with Them?

AI-generated conceptual illustration distinguishing public-facing websites from internal information networks. It does not show North Korea’s actual network topology, cabling, government buildings, or equipment locations.

Most of the services identified in the reports were externally accessible websites using North Korea’s national domain, .kp.

That is not the same thing as the country’s entire communications system.

North Korea also operates a restricted domestic information network commonly called Kwangmyong. Unlike the open global internet, it is designed to provide access to selected information and services within the country.

Ordinary North Korean citizens cannot freely browse the global web in the way users in many other countries can. Domestic information services and international internet access are tightly controlled and serve different purposes.

There is also no publicly verified evidence showing that the Party’s confidential communications, military command systems, and other sensitive government networks depend on the same infrastructure as the external websites affected in October.

Consequently, an overseas visitor’s inability to load KCNA’s website does not establish that officials in Pyongyang lost their own communications or that military command structures stopped functioning.

So why could so many public websites be affected at once?

One explanation is shared infrastructure. Multiple websites can depend on the same routing equipment, address-management services, upstream network connections, or hosting infrastructure. A disruption at a common point can affect many services simultaneously.

Yonhap cited experts who pointed to the concentration of North Korea’s externally accessible website infrastructure and potential weaknesses in its communications links.

But the wider network is not accurately described as a single cable to China.

Specialist publication NK PRO has documented North Korea’s use of Chinese telecommunications providers alongside alternative routing through Russia’s TransTeleCom. Its October reporting also discussed additional international routing arrangements.

The outages suggest vulnerabilities in the infrastructure supporting North Korea’s external online presence. They do not prove that the country’s entire internal communications network failed.

That distinction may sound technical, but it is essential when a website outage is being discussed alongside rumors of a national leadership crisis.

North Korea Also Lost Internet Access in 2014. That Outage Lasted 9 Hours and 31 Minutes

October 2026 was not North Korea’s first major internet disruption.

On December 22–23, 2014, amid tensions over the cyberattack on Sony Pictures Entertainment and a film featuring a fictional assassination of Kim Jong Un, North Korea suffered a major loss of external internet connectivity.

Network-monitoring company Dyn Research reported an outage lasting nine hours and 31 minutes. External attacks were suspected, but the party responsible for the outage was not conclusively identified.

At first glance, comparing that event with the 2026 disruption produces an impressive number.

Comparison	2014 outage	2026 disruption
Reported duration	9 hours 31 minutes	About 32 hours
Duration in minutes	571	1,920
What the duration measures	A continuous major connectivity outage	Elapsed time across intermittent failures and recoveries
Responsible attacker	Not conclusively identified	Not identified

Converting both durations into minutes gives us:

2014: (9 × 60) + 31 = 571 minutes.

2026: 32 × 60 = 1,920 minutes.

Dividing 1,920 by 571 produces approximately 3.36, or about 3.4 when rounded to one decimal place.

So the 2026 disruption covered a period around 3.4 times as long as the reported continuous outage in 2014.

But here comes the catch: the two measurements do not describe the same kind of downtime.

The 2014 figure refers to a continuous major loss of connectivity. The 2026 figure includes periods when access temporarily returned.

Without comparable measurements of total downtime, affected services and traffic volumes, it would be misleading to claim that the 2026 event was 3.4 times more severe.

The arithmetic works. The interpretation requires considerably more care.

Was the Outage Connected to Kim Jong Un’s Death Rumors?

The timing invited speculation. Rumors about Kim Jong Un’s death circulated around October 19, and major website disruptions began the following morning.

But no verified evidence establishes that the websites were disabled to conceal the rumored death or that the disruption resulted from a struggle within North Korea’s leadership.

On October 23, South Korea’s National Intelligence Service reportedly assessed the death rumors as false.

During roughly the same period, Kim’s sister, Kim Yo Jong, was associated with an inspection of border fortification work near the inter-Korean military boundary. His daughter, commonly known as Kim Ju Ae, was reported to have accompanied him to a garment and footwear exhibition on October 19.

Neither event proves that the sister or daughter assumed the powers of supreme leader.

South Korean intelligence officials also did not regard Kim Yo Jong’s border inspection alone as evidence that her formal political status had changed.

Then came an additional development. On October 25, North Korean state media reported that Kim Jong Un had visited Dandong, China, the previous day. Kim Yo Jong was among the officials accompanying him.

The visit provided further evidence of Kim Jong Un’s continuing public diplomatic activity, rather than a confirmed transfer of power to another family member.

Nor would disruptions to publicly accessible websites automatically give foreign governments greater leverage over North Korea.

Online availability, military capability, nuclear forces, and diplomatic bargaining power are distinct matters. A problem with one does not necessarily establish a change in the others.

We can establish that the death rumors and the internet disruptions occurred within the same week. We cannot establish that one caused the other.

The Strangest Part Is Who Had to Explain the Outage

North Korean state media had published remarkably detailed figures about the garments and shoes displayed at Kim Jong Un’s October 19 exhibition visit.

Yet in reporting reviewed through October 23, there was no corresponding public explanation from North Korean authorities establishing the cause of the widespread website disruptions.

Silence is not proof of a cover-up. It does, however, leave an information gap.

Much of what outsiders learned about the incident came instead from South Korean journalists and foreign network-monitoring specialists.

Those observers could investigate connection failures and traffic patterns without relying entirely on North Korea’s official account.

And that is perhaps the most revealing part of the episode: the outside world could observe significant interruptions to North Korea’s public information channels, yet had little reliable visibility into what was happening within the state itself.

Terms That May Need a Quick Explanation

Editor’s Note

A death rumor about Kim Jong Un, followed the very next day by disruptions affecting 42 official websites. Come on. That is the sort of combination that would have landed on the cover of a gloriously dubious Cold War gossip magazine.

But the detail that kept bothering me was not the supposed conspiracy. It was the number 32.

Thirty-two hours sounds like a solid block of darkness. Look at the observations more closely, though, and the connections were coming and going. The country had not simply vanished from the web for 32 uninterrupted hours.

That alone changes the story.

And just because external websites became inaccessible does not mean Kim’s sister and daughter were suddenly running around an emergency command bunker. We have no evidence of that.

What interests me more is how far the public-facing information systems are from the places where actual political power is exercised.

Here is a state famous for controlling information, yet foreign companies and journalists were the ones investigating its connection failures.

There is something rather ironic about that.

In the end, I am less concerned with the dramatic claim that North Korea’s internet went down than with a more awkward question: how can outsiders determine what really stopped working, and what continued operating behind the country’s closed doors?

That is the part of the story I would rather investigate than another rumor about a secret power struggle.

This article is based on reporting and network observations reviewed through October 24, 2026, with Kim Jong Un’s diplomatic activity reported on October 25 added afterward. The observed outages, evidence consistent with DDoS traffic, unverified death rumors, and succession speculation are treated separately. The identity of the attacker and any causal connection to the death rumors remain unconfirmed.

References