Kenyan Presidential Website Defaced in Ransomware Attack, Investigation Underway
Kenya's presidential website recently fell victim to a cyberattack, which saw its homepage defaced with an anti-government message demanding a five-bitcoin ransom. While the site has since been restored, authorities are investigating the incident, with no evidence of sensitive data exfiltration reported.
# Kenya's Presidential Website Hit by Ransomware Attack
Kenya is currently investigating a cyberattack that temporarily defaced the official website of President **William Ruto**. The incident, which occurred on a Saturday, saw the website's homepage replaced with an anti-government message demanding a ransom of five bitcoins (approximately $330,000 USD).
The attackers displayed a cryptocurrency wallet address and threatened to publish unspecified information about President Ruto if their demands were not met. By the following Monday, access to the website had been restored, according to local media reports.
## Government Response and Investigation
**William Kabogo**, Cabinet Secretary for Information, Communications, and the Digital Economy, confirmed the cyberattack and stated that government cybersecurity teams are actively investigating the incident.
"As a precautionary measure, access to the Presidential website was temporarily restricted to facilitate containment, forensic analysis and restoration efforts," Kabogo said in a statement. He emphasized that authorities have found no evidence of unauthorized access to sensitive data, data exfiltration, or loss of information, asserting that government systems and digital services remain secure and operational.
Screenshots of the defaced website, circulated on social media, showed the attackers claiming this was their "third" warning to the president before threatening a data release. However, authorities have not confirmed this claim, and no verified data leak has been made public.
## A History of Cyber Incidents
This is not the first time Kenyan government websites have been targeted. In November 2025 (sic), a coordinated cyberattack temporarily disrupted multiple government websites, including those of the presidency and several key ministries such as Interior, Health, Education, Energy, Labor, and Water. That incident involved the defacement of several ministry websites with white supremacist slogans.
