A Quarter Marked by Shutdowns, Broken Cables, and Blackouts
Cloudflare’s network spans more than 285 cities in over 100 countries, interconnecting with over 11,500 network providers. That vantage point allows us to observe how Internet disruptions play out in real time, whether they stem from government mandates, natural disasters, or infrastructure failures. The first quarter of 2023 offered no shortage of examples, though this overview is a summary of observed events, not an exhaustive catalog.
State-Ordered Blackouts and Restrictions
Government-directed shutdowns remained a recurring theme in Q1. In Iran, where connectivity curbs had been tied to protest activity for months, a more targeted disruption occurred on January 19. Access was restricted across AS44244 (Irancell) and AS197207 (MCCI) between approximately 08:00 and 11:30 local time, with lower traffic observed in Alborz Province, Fars, Khuzestan, and Razavi Khorasan. The purpose was to prevent cheating on academic exams, a rationale seen in other countries as well.
A Mauritania outage also had security roots. On March 6, traffic fell sharply around 10:00 local time at the country’s three major mobile networks — AS37541 (Chinguitel), AS29544 (Mauritel), and AS37508 (Mattel) — during a manhunt for four escaped jihadist prisoners. Recovery only began around 13:45 local time on March 12, after authorities reported that three of the escapees had been killed and the fourth detained.
In Punjab, India, a mobile Internet shutdown began March 18 around 12:30 local time over fears of protest-related violence. While the initial order was meant to last only a day, it was extended several times. Traffic at AS38266 (Vodafone India), AS45271 (Idea Cellular Limited), AS45609 (Bharti Mobility), and AS55836 (Reliance Jio Infocomm) returned to normal around 12:30 local time on March 21, though some districts reportedly remained disconnected until March 23 or 24.
When the Cables Go Down
Physical infrastructure failures were a common cause of disruption. In Bolivia, ISP Cometco (AS27839) reported issues with international fiber links on January 12. Bolivia Network traffic dropped by approximately 80% starting around 16:00 local time before recovering roughly eight hours later. Since Bolivia is landlocked, the disruption likely involved terrestrial links to neighboring countries rather than submarine cables.
A more extended outage hit Anguilla on February 18, when a subsea fiber break impacted both FLOW and DIGICEL. Starting around 09:00 local time, traffic dropped visibly at country level, at AS2740 (Caribbean Cable Communications), and to a lesser extent at AS11139 (Cable & Wireless). The break was likely on the Eastern Caribbean Fiber System (ECFS), the island’s only submarine cable connection. Service levels returned to normal after more than two days, around 15:00 local time on February 20.
Brief fiber cuts also caused shorter disruptions: Grameenphone in Bangladesh suffered an outage on February 23 between 11:45-14:00 local time due to road maintenance cutting fiber, while Venezuela saw a more serious near-complete outage on AS8048 (CANTV) starting February 28 around midnight local time. CANTV acknowledged an outage in its fiber optic network, with traffic recovering by 17:30 local time.
Blackouts Bring Traffic Down
Power grid failures were another frequent cause of Internet disruption in Q1. A country-wide outage in Pakistan on January 23, caused by a sudden frequency drop in the transmission system, affected over 220 million people. Internet traffic fell by as much as 50% from normal levels, starting around 07:34 local time, before recovering on January 24 around 04:15 local time.
A mass power outage on the island of Bermuda, reported by utility BELCO on February 3, caused Internet traffic to drop significantly around 19:10 local time. The disruption lasted over five hours, with BELCO tweeting that all circuits had been restored by 21:45 local time. In Argentina, soaring temperatures on March 1 triggered a large-scale blackout. Internet traffic dropped by roughly one-third between 16:30 and 19:30 local time, visibly impacting Buenos Aires, Cordoba, Mendoza, and Tucuman.
Kenya experienced a nationwide power outage on March 4, with Kenya Power issuing a customer alert about losing bulk power supply due to a system disturbance. The country’s Internet traffic had already dropped about an hour before the alert, which came at 18:25 local time. By midnight local time, Kenya Power claimed electricity had been restored nationwide, and traffic volumes soon followed suit.
Earthquake Aftershocks in Turkey
The most severe natural disaster of the quarter struck Turkey on February 5, when a magnitude 7.8 earthquake hit 23 km east of Nurdağı at 04:17 local time, the strongest quake to hit the country since 1939. Internet connectivity was significantly disrupted across multiple regions. While traffic volumes were already low at that early hour, they dropped further at the time of the quake. Nearly half a day later, traffic in selected locations was 63-94% lower than the previous week’s levels. A month after, and following several aftershocks, most traffic had recovered, though some regions were still struggling to regain normal connectivity levels.
Extreme weather takes a toll
New Zealand and the South Pacific
Cyclone Gabrielle, described at the time as New Zealand's biggest weather event in a century, struck the country's northern regions on February 14 (11:00 UTC on February 13), causing widespread infrastructure damage and power outages that affected tens of thousands of homes. Internet disruptions in the Gisborne and Hawkes Bay regions lasted several days, beginning at 00:00 local time. Peak traffic volumes in both regions did not return to pre-cyclone levels until around February 19.
Later in February, Cyclone Judy—a Category 4 storm—hit Vanuatu, a South Pacific nation of roughly 80 islands spanning 1,300 kilometers. The cyclone damaged homes and caused power outages, leading to a significant drop in national Internet traffic. On February 28, traffic fell by nearly 80% as the storm struck, and recovery to early-February levels took close to two weeks.
Malawi
Cyclone Freddy, reported as the longest-lasting and most powerful cyclone on record, reached Malawi during the weekend of March 11-12 and continued into Monday, March 13. The storm's damage disrupted Internet connectivity in the east African country, with traffic dropping around 11:00 local time (09:00 UTC) on March 13. The outage persisted for more than two days, with traffic levels recovering around 21:00 local time (19:00 UTC) on March 15.
Technical failures and outages
South Africa
South African service provider RSAWEB first flagged an issue affecting its cloud and VOIP platforms just before 07:00 local time (05:00 UTC) on February 1. The company subsequently confirmed that internal systems, as well as fiber and mobile connectivity, were also impacted. Traffic on RSAWEB's network dropped at 06:30 local time (04:30 UTC), a point when it would normally be increasing for the day. Around 14:00 UTC, RSAWEB stated that engineers were actively restoring services, and the traffic graphs show a sharp increase shortly thereafter with gradual growth through the evening. Full restoration across all impacted platforms took a full week, according to a February 8 update.
Italy
An unspecified "international interconnectivity problem" at Telecom Italia caused a multi-hour Internet disruption in Italy on February 5. At a country level, a nominal traffic drop appears starting around 11:45 local time (10:45 UTC), with volatility lasting through 17:15 local time (16:15 UTC). The impact is far more visible in the graphs for Telecom Italia's AS3269 and AS16232, both of which show a significant loss of traffic and greater volatility over the five-plus-hour event.
Myanmar
A fire at an exchange office of MPT (Myanma Posts and Telecommunications) on February 7 disrupted Internet service for the provider's customers. The company said the disruption affected its call center, fiber Internet, mobile Internet, and mobile and telephone communications. Traffic on MPT-owned AS9988 and AS45558 dropped significantly at 10:00 local time (03:30 UTC), with substantial recovery by 22:00 local time (15:30 UTC).
Republic of the Congo
Congo Telecom issued a public notice on March 15 alerting users to a service disruption caused by a "network incident." The effect was visible at a country level, with traffic dropping sharply at 00:45 local time (23:45 on March 14 UTC), driven by complete outages at both MTN Congo and Congo Telecom. MTN Congo's traffic began recovering around 08:00 local time (07:00 UTC), while Congo Telecom's recovery started later, around 17:00 local time (16:00 UTC). Congo Telecom confirmed on March 16 that the nationwide outage was resolved. MTN Congo did not acknowledge the event publicly, and neither operator provided further specifics on the cause.
Lebanon
Disruptions observed at AS39010 (Terranet) and AS42334 (Mobi) in Lebanon on March 29 may have been linked to a strike at upstream provider Ogero Telecom. The chairman of Ogero warned that the network would completely stop if an agreement with the government was not reached, as generators would gradually run out of fuel. Traffic at both affected networks dropped around 05:00 local time (03:00 UTC) and recovered approximately 4.5 hours later, at 09:30 local time (07:30 UTC).
Cyberattacks
South Korea
South Korean Internet provider LG Uplus suffered two brief disruptions on January 29, reportedly caused by possible DDoS attacks. The first occurred at 03:00 local time (18:00 UTC on January 28), the second at 18:15 local time (09:15 UTC). Both affected traffic on LG-owned AS17858 and AS3786. The company was reportedly hit by a second pair of DDoS attacks on February 4.
Guam
Docomo Pacific reported an outage on March 17 affecting multiple services, with a subsequent update confirming a cyber security incident and attacks on some servers. The outage is visible at a country level as a significant traffic drop starting around 10:00 local time (00:00 UTC). For AS3605 (ERX-KUENTOS/Guam Cablevision/Docomo Pacific), the cited incident caused a near-complete loss of traffic starting around 05:00 local time (19:00 on March 16 UTC). Traffic returned to normal levels by 18:00 local time on March 18 (08:00 UTC).
Conflict-related disruptions in Ukraine
The conflict in Ukraine entered its second year in February 2023. As in the fourth quarter of 2022, disruptions during Q1 were frequently linked to attacks on electrical infrastructure.
One such incident occurred in Odessa on January 27, following Russian airstrikes that damaged local energy infrastructure. Internet traffic in Odessa typically begins to climb just before 08:00 local time (06:00 UTC), but did not do so that morning. Traffic remained lower than the previous week's levels for approximately 18 hours.
Russian attacks on energy generation and distribution facilities on March 9 caused power outages that disrupted Internet connectivity in multiple regions. Traffic dropped below normal levels after 02:00 local time (00:00 UTC) on March 9. Kharkiv traffic fell over 50% compared to the previous week, while Odessa saw drops of as much as 60%. Traffic in Odessa, Mykolaiv, and Kirovohrad Oblast recovered by around 08:00 local time (06:00 UTC). In Kharkiv, the disruption lasted nearly two days, with traffic returning to normal levels around 23:45 local time (21:45 UTC) on Friday, March 10.
Q1 2023: A Busy Quarter for Internet Disruptions
The first three months of 2023 saw a particularly high level of Internet disruption activity. While it is too early to call it a trend for the year, the frequency of these events, especially those directed by governments, is notable given how regularly such shutdowns occurred throughout 2022.
Independent data supports this observation. Civil society organization Access Now has published its Internet shutdowns in 2022 report, documenting at least 187 government-directed or other disruptions across 35 countries last year. This context helps frame the activity seen in Q1 2023.
Cloudflare Radar contributes to Access Now's #KeepItOn initiative, providing traffic data to help quantify the real-world effect of these shutdowns and other outages. Observability into live events remains publicly available via the Cloudflare Radar Outage Center (CROC) and through the Radar API for programmatic access.
For ongoing updates on Internet disruptions, you can follow @CloudflareRadar on Twitter or on the social web at noc.social/@cloudflareradar.
