Kenya confirms government cyber breach occurred

Kenya’s cybersecurity authorities have acknowledged a breach in the e-government sector earlier this year. The Communications Authority of Kenya (CA) confirmed the incident in its latest quarterly report, but did not specify which system was affected or how attackers gained access.

The latest Cybersecurity Report, its 43rd edition, examines the three-month span from July through September 2026 and recaps discussions from the 56th session of the National KE-CIRT/CC Cybersecurity Committee, convened in Nairobi on September 23. This committee includes over 50 government and private entities responsible for safeguarding essential digital infrastructure.

At the gathering, officials from the e-government sector urged tougher safeguards for their digital assets and a more aggressive stance on data protection after experiencing a security failure. They are also addressing new compliance demands from the Office of the Data Protection Commissioner (ODPC).

The CA report does not provide details on the breach, including the affected agency, the method of attack, or whether personal data was exposed. The only indication of timing is that the breach occurred earlier in the year, which may predate the quarter covered in the report.

Cyber Risks Rise Sharply

Cyber risks targeting government networks have grown more alarming. The report highlights a surge in detected threats during this period, with the National KE-CIRT/CC identifying nearly 2.7 billion suspicious activities—up 14.45% compared to the previous quarter. Government platforms appear as primary victims in four out of the six attack types documented.

Among the rising threats are malware attempts (up 20.01% to 70.8 million), web-based attacks (up 57.62% to 27.4 million), brute-force intrusions (up 85.41% to 44.9 million), and a sharp decline in denial-of-service incidents (down 97.18% to 23,124). The report attributes the rise largely to inadequate patching, low awareness of phishing, and attackers’ growing use of AI.

The report notes that successful brute-force attacks, often enabled by exposed databases, weak login controls, and poorly secured remote access, granted hackers entry to vital systems, potentially compromising confidential data. However, no specific numbers are provided, and no direct connection to the e-government breach is established.

Addressing cyber risks remains a top priority for authorities. The report advises implementing regular software updates, enforcing multi-factor authentication, strengthening firewall management, and improving incident response coordination. While threat detection volumes are high, these figures represent potential risks rather than confirmed breaches.

Presidential Website Incident

The official report makes no mention of whether the Presidential Website Incident was addressed during the committee meeting. On July 18, the Ministry of Information, Communications, and the Digital Economy stated that the ICT Authority had uncovered a cyber incident on the site, activated emergency protocols, and restricted access to prevent further damage and allow digital forensics.

According to the ministry, no evidence of unauthorized data access, theft, or loss was found at that time, and restoration efforts were underway. Though the report does not tie the breach to the presidential website, the timing suggests it may be the closest publicly documented case.

Critical details about the breach remain unclear. While the report confirms an incident occurred, it lacks sufficient information to assess its impact or the effectiveness of the response. Unanswered questions include which agency was compromised, the investigation’s findings, whether personal information was involved, how the ODPC’s audit demands arose, and which security fixes have been completed.