President’s Website Puts Kenya’s Cyber Defences Under Scrutiny

The defacement of Kenya’s official presidential website has renewed attention on the country’s cybersecurity posture, after attackers briefly took control of the public-facing platform and demanded a ransom before the site was taken offline and restoration efforts began.

Visitors to president.go.ke on Saturday found the homepage replaced with messages directed at President William Ruto, alongside a cryptocurrency wallet address and a demand for five Bitcoin in exchange for withholding the release of unspecified information. State House acknowledged the incident, while the Ministry of Information, Communications and the Digital Economy later confirmed that the ICT Authority had activated its cybersecurity incident response procedures to contain the attack and begin forensic investigations.

The ministry said there was no evidence of unauthorised access to sensitive government data, data exfiltration or loss of information, stressing that government digital services remained secure and operational. The website was deliberately taken offline to support investigations and restoration, while officials said forensic analysis was continuing to establish how the attackers gained access.

The incident has drawn attention because it targeted one of Kenya’s highest-profile government websites, even though the presidential website serves primarily as an information portal rather than a platform handling citizen services or sensitive government transactions. As a result, cybersecurity experts note that a website defacement does not automatically indicate that attackers have compromised internal government systems or databases.

The attack nevertheless adds to a growing pattern of cyber incidents affecting Kenya’s public sector. In November last year, multiple government websites were simultaneously defaced or disrupted, while in 2023 a major distributed denial-of-service (DDoS) attack temporarily affected the eCitizen platform. Government data has also shown that Kenya continues to experience billions of attempted cyber threat events every quarter, with system vulnerability exploitation accounting for the overwhelming majority of detected attacks.

The timing is also significant, coming only weeks after Parliament approved the establishment of the National Cybersecurity Agency, which is expected to become the country’s apex institution for coordinating cybersecurity policy and incident response. The latest attack is likely to place renewed focus on how the new agency will work alongside existing institutions such as the ICT Authority and the National Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC).

While the immediate operational impact appears limited to the temporary disruption of the presidential website, the incident highlights the reputational risks associated with attacks on government digital assets as Kenya continues expanding online public services. It also underscores the importance of maintaining strong cybersecurity practices across public-facing government websites, including timely software updates, stronger access controls, continuous monitoring and clear incident response procedures.

Authorities have not attributed the attack to any individual or group, and no credible claim of responsibility has been confirmed. The government’s forensic investigation is expected to determine how the website was compromised, whether any wider systems were affected and whether further legal action will follow under Kenya’s Computer Misuse and Cybercrimes Act.