Skip to content
Rabin Poudyal
Page 9-1
9-1 Incidents

9.13South Korea's government data centre fire

A fire during battery relocation work at the government's main data centre in Daejeon stopped 709 public systems, and destroyed a cloud drive for civil servants that had no copy anywhere else.

National Information Resources Service, South Korea · 26 September 2025 · Resilience and recovery

  1. 1Read
    Blast radius
    709 government information systems by the final official count, 96 of them burned in one server room, including the standard document system and G-Drive, the cloud storage central-government officials used for their work files: 858 terabytes, used by about 125,000 officials across 74 agencies. Its data was declared lost.
    Duration
    The fire started at about 20:20 Korea Standard Time on 26 September 2025 and was fully out at about 18:00 the next day, some 22 hours later by the government's account. The Daejeon systems were back on 14 November, day 49, and the last of the 709 on 30 December 2025, day 95.
  2. 2Follow

    What happened, in order

    1. Jun 2024

      The National Information Resources Service (NIRS) contracts for relocating its server-room batteries, prompted by a 2022 data centre fire elsewhere. The work is later passed down through illegal subcontracting to firms without an electrical-construction registration.

    2. 26 Sep, ~20:20 KST

      During work to move lithium-ion UPS (uninterruptible power supply) batteries from a fifth-floor server room to the basement, a fire breaks out. The batteries were installed in 2014, about a year past their recommended ten-year service life, and were to be reused after the move.

    3. 26 Sep, 20:26 KST

      Firefighters arrive. Power to the fifth floor is cut at 23:02. Water is held back at first because of the servers.

    4. 27 Sep, ~18:00 KST

      The fire is fully out, after flaring up again following an earlier containment. All 384 battery packs in the room are destroyed.

    5. 30 Sep 2025

      The government's briefing: 647 systems are affected, 96 of them burned in room 7-1, and 87 have been restored. The other systems were shut down as a precaution and are restarted in stages.

    6. 1 Oct 2025

      The Ministry of the Interior and Safety says G-Drive has no backup and cannot be recovered. Of the 96 burned systems it is the only one with no copy of its data elsewhere.

    7. 9 Oct 2025

      The count of affected systems is corrected to 709, after systems were itemised differently. 193 are back.

    8. 14 Nov 2025

      All 693 systems to be restored in Daejeon are back, six days ahead of the ministry's target.

    9. 30 Dec 2025

      The last systems, 16 of them moved to the Daegu centre, are restored, and the government ends its disaster response.

    10. 7 Sep 2026

      The Board of Audit and Inspection publishes its audit of the fire, the response and the recovery.

  3. 3Find

    Root cause

    Note

    The fire was started by the work, not by the batteries failing on their own. The police, based on the National Forensic Service's analysis, found that workers had cut only the UPS main power and one of eight battery racks before dismantling, and had not disconnected and insulated the control-box wiring. The forensic service ruled out thermal runaway, a battery failing by itself. The audit found that dismantling went ahead without all rack power cut and without proper insulation of the cable ends, and that a spark between racks 4 and 5 started the fire. The batteries were charged to about 80 to 90 percent; manufacturers' manuals say to discharge them below 30 percent before moving them.

    One room held a large share of the state. The fifth floor's three server rooms held 330 systems, 51 percent of the total at the time. Room 7-1 held 96, among them G-Drive. NIRS backed up most systems daily to other equipment in the same centre, and more than 60 percent of major systems to a separate backup centre. G-Drive was the exception. The ministry said that because it was "large-capacity, low-performance storage", it was not backed up externally.

    The recovery was slow because standby capacity elsewhere was thin. The audit found that only 54 of the 709 systems had a disaster recovery system at a remote site, that none of them ran active-active, with both sites serving at once, and that only 7 were actually used to recover. Top-priority systems took 10.8 days on average to come back, from 2 to 35.

    What one fire could reach On the fifth floor of the National Information Resources Service's Daejeon centre, battery racks were dismantled with only one of eight cut off, and the fire burned room 7-1's 96 systems, including G-Drive, 858 terabytes with no copy outside the room. Rooms 7 and 8 on the same floor held 234 more systems, and most systems' daily backups sat on other equipment in the same centre. At other sites, only 54 of the 709 affected systems had remote disaster recovery, and 7 were used to recover. Systems in Daejeon were back on day 49 and the last of the 709 on day 95, 30 December 2025. Daejeon centre Battery racks 1 of 8 cut off Room 7-1 96 systems burned G-Drive 858 TB, no copy outside Rooms 7 and 8 same floor, 234 systems Same-centre backups daily, other equipment Other sites Remote recovery 54 of 709 systems Used to recover 7 systems 647 systems stopped at first, corrected to 709; fifth floor held 330, half the total Daejeon systems back on day 49, the last of the 709 on day 95, 30 December 2025
    What the fire could reach: one floor held half the systems, G-Drive had no copy outside the room, and few systems had standby capacity at another site.
  4. 4Trace

    Why it got through

    Every layer had a gap. The work was meant to reduce a known fire risk, and the audit found it went to unregistered subcontractors with no work plan required. The batteries were past their service life and charged high. Live racks were dismantled. NIRS asked firefighters to hold back on water and did not follow its fire manual, and an earlier fire safety inspection had been refused because the server room was a security zone.

    The backups assumed the building would survive. Copies on other equipment in the same centre protect against a disk or a server failing, not against the room burning. A remote disaster recovery centre at Gongju was finished in May 2023, but by the end of 2025 two of its three server rooms stood empty, and in April 2024 the ministry had barred disaster recovery investment in its 2025 budget guidelines before reversing that in April 2025. For G-Drive, the reason given for having no off-site copy was the size and speed of the storage. Ministries that had followed the guidance to keep work files on G-Drive instead of their own computers lost the most: the Ministry of Personnel Management, the only one that kept its files on G-Drive alone, rebuilt them from a month of files cached on PCs, emails, official letters and printouts.

  5. 5Check

    The lesson

    A backup in the same building is not a backup, and a copy you never restored is not one you can count on. Keep copies far enough away that one event cannot reach both, and decide in advance how fast each system has to come back.

  6. 6Change

    What changed afterwards

    The National Assembly approved 49 billion won for emergency recovery equipment and moving to a private cloud, and 343.4 billion won for improving disaster recovery and gradually relocating the Daejeon centre. The government planned active-active disaster recovery for major systems and tougher standards for batteries, power and cooling in its data centres, and in February 2026 decided to close the Daejeon centre by 2030. G-Drive reopened in December 2025 on a private-sector service, without its old data.

    In October 2026 the Interior Ministry set a target to restore core systems within one hour, with disaster recovery for 13 core systems first, by the first half of 2027. Police referred 19 people and four companies to prosecutors for negligence and breaches of electrical construction law; as of June 2026 prosecutors had not decided whether to indict. The audit estimated the total damage at 351.1 billion won.

  7. 7Verify

    Where the sources differ

    • The number of G-Drive users varies. Korea JoongAng Daily, the article Hacker News linked, says files "saved individually by some 750,000 civil servants". Korean reports of the government's briefing say 191,000 registered users across 74 agencies, of whom about 125,000 used it. This page uses the Korean figures.
    • The count of affected systems was 647 in the first week and was officially corrected to 709 on 9 October, by itemising the same systems differently. Some reports say all systems were back after 49 days; that was the Daejeon centre only, and the last of the 709 came back on day 95.
    • Times differ. The fire is reported to have started at 20:15, 20:16 or 20:20, and Korea JoongAng Daily reported it extinguished at 9:50 the next morning, about 13 hours, while the government and Korean wire reports say it was fully out at about 18:00, about 22 hours. Korea JoongAng Daily's headline says 386 battery packs and its text 384.
    • The common telling is a lithium-ion battery fire. The forensic service ruled out the batteries failing on their own; the police and the audit put the cause on how the work was done. The batteries were being moved for reuse, not replaced.
    • A later Digital Daily report says G-Drive's backup existed but sat in the same room, because copying it to another centre would have taken over a month, so original and copy burned together. The government's own statement on 1 October was that it had no backup. The audit findings here are as reported by Financial News and Digital Daily; the audit report itself could not be fetched.
  8. 8Source

    Sources

  9. 9Go