Kenyan authorities are investigating a cyberattack that defaced President William Ruto’s official website over the weekend, replacing the homepage with a ransom message and a cryptocurrency wallet address.
The government pulled president.go.ke offline on Saturday and has since said it found no evidence that sensitive data was taken.
The intruders demanded five bitcoins, worth roughly 41 million Kenyan shillings (about $317,000), and threatened to leak material if they were not paid by that evening, according to Kenyan outlets that saw the page before it came down. The message, addressed to Ruto, claimed it was the third such warning.
The defaced homepage, first flagged shortly after 2pm on Saturday, carried derogatory language and unspecified allegations against the president alongside the wallet address. By that point the usual presidential fare of speeches and press releases had been wiped from view.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
William Kabogo, the cabinet secretary for information, communications and the digital economy, confirmed the breach on Saturday and said access to the site had been “temporarily restricted to facilitate containment, forensic analysis and restoration efforts”.
He added that there was “no evidence of unauthorised access to sensitive data, data exfiltration, or loss of information”.
The National Computer and Cybercrime Coordination Committee, known as NC4, was activated to lead the response, working alongside State House technical teams and outside partners.
Kabogo said government systems and digital services “remain secure and operational”, and the site was restored by Sunday with its speeches, press releases and communications intact.
No group has claimed responsibility, and officials have not said how the attackers got in or whether they are treating the demand as anything more than opportunism.
The identities behind the defacement remain unknown, and the government has not indicated when its forensic review will conclude.
The timing is awkward for an administration that has spent two years fielding both street protests and digital intrusions.
Ruto’s government has faced sustained Gen Z-led demonstrations over taxation, the cost of living and police conduct, protests that have played out as much on social platforms as on Nairobi’s streets.
Its online infrastructure has been probed repeatedly in that period, and the defacement of the head of state’s own site carries a symbolic sting the government was quick to try to contain. Officials moved within hours to restrict access and frame the episode as contained rather than catastrophic.
In 2023, the hacktivist group Anonymous Sudan knocked out the eCitizen portal Kenyans use for thousands of government services, in a DDoS campaign that briefly disrupted everything from passport applications to mobile-money transfers.
The ICT secretary at the time, Eliud Owalo, acknowledged the attack but insisted no data had been compromised, the same reassurance offered this week.
A broader assault in 2025 hit dozens of state websites at once, among them those of State House and the interior, energy, health and education ministries.
Government platforms have become a standing target, with website defacement and ransomware among the most common methods deployed against them.
National figures point the same way. Analysts tracking the country’s systems have logged billions of attempted intrusions over a recent three-month stretch, with Nairobi accounting for the largest share of reported cybercrime, from unauthorised access to identity theft.
Kenya has positioned itself as one of the continent’s leading digital economies, with Nairobi long promoted as East Africa’s tech hub.
The government recently approved a National Cybersecurity Agency Order meant to centralise policy and incident response, a framework that a defaced presidential homepage has now put to an early test.
How quickly the site came back, officials will argue, is the measure of whether that investment is paying off.
Whether the ransom was ever a serious prospect, or the point was simply to embarrass the president on his own front page, the investigators have not said.
