Kenyan Presidential Website Defaced in Ransomware-Style Cyberattack
Kenyan authorities are investigating a cyberattack that temporarily defaced President William Ruto’s official website over the weekend, replacing its homepage with an anti-government message and a ransom demand. The attackers threatened to publish unspecified information about the president unless a payment of five bitcoins approximately $330,000 was made to a provided cryptocurrency wallet.
The breach occurred on Saturday, with the defaced site displaying the ransom note before access was restricted on Sunday. By Monday, the website had been restored, according to local reports. The identity of the attackers remains unknown, and there is no evidence they accessed or leaked sensitive government data.
Information, Communications and the Digital Economy Cabinet Secretary William Kabogo confirmed the incident, stating that cybersecurity teams were conducting a forensic analysis. He assured that no unauthorized data access, exfiltration, or loss had been detected, and that government systems remained secure. Screenshots of the defaced site, circulated on social media, included claims of prior warnings to the president, though authorities have not verified these assertions.
This incident follows a November 2025 cyberattack that disrupted multiple Kenyan government websites, including those of the presidency and key ministries. Those breaches involved white supremacist slogans, marking a shift in the nature of recent cyber threats targeting the country’s digital infrastructure.
Source: https://therecord.media/kenya-probes-hack-of-presidents-website-after-ransom-demand
Kenya School of Government cybersecurity rating report: https://www.rankiteo.com/company/kenya-school-of-government
"id": "KEN1784636638",
"linkid": "kenya-school-of-government",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Public, website visitors',
'industry': 'Public Sector',
'location': 'Kenya',
'name': 'Government of Kenya (Presidency)',
'size': 'Large',
'type': 'Government'}],
'data_breach': {'data_exfiltration': 'Threatened, not confirmed',
'sensitivity_of_data': 'High (presidential information)',
'type_of_data_compromised': 'Unspecified (threatened, not '
'confirmed)'},
'date_detected': '2023-10-07',
'date_publicly_disclosed': '2023-10-08',
'date_resolved': '2023-10-09',
'description': 'Kenyan authorities are investigating a cyberattack that '
'temporarily defaced President William Ruto’s official website '
'over the weekend, replacing its homepage with an '
'anti-government message and a ransom demand. The attackers '
'threatened to publish unspecified information about the '
'president unless a payment of five bitcoins (~$330,000) was '
'made.',
'impact': {'brand_reputation_impact': 'Negative publicity',
'data_compromised': 'Unspecified information about the president '
'(threatened, not confirmed)',
'downtime': 'Temporary (restored by Monday)',
'operational_impact': 'Temporary defacement, restricted access',
'systems_affected': 'Presidential website'},
'investigation_status': 'Ongoing',
'motivation': 'Extortion, Political',
'ransomware': {'data_exfiltration': 'Threatened, not confirmed',
'ransom_demanded': '5 bitcoins (~$330,000)',
'ransom_paid': 'No'},
'references': [{'date_accessed': '2023-10-09',
'source': 'Local reports, social media'}],
'response': {'communication_strategy': 'Public statement by Cabinet Secretary',
'containment_measures': 'Website access restricted',
'incident_response_plan_activated': 'Yes',
'recovery_measures': 'Forensic analysis ongoing',
'remediation_measures': 'Website restored'},
'stakeholder_advisories': 'Government assurances of system security',
'title': 'Kenyan Presidential Website Defaced in Ransomware-Style Cyberattack',
'type': 'Website Defacement, Ransomware'}