Cyber attackers steal company data in breach at Business Registration Services
BRS, one of the government’s most data-rich organisations, holds sensitive details on registered companies, their owners, directors, and beneficial owners.
The Business Registration Services (BRS) has been hit by a major data breach, resulting in sensitive information about private companies being exposed to the public.
The cyberattack, believed to have taken place on the night of January 31, has left the organisation scrambling to contain the situation.
More To Read
- Geopolitical tensions and adoption of AI top key threats to cyber security, global report warns
- Kenya alleges coordinated digital attack, cites AI deepfakes, disinformation
- Over 100 cyber attacks targeting key government infrastructure recorded in eight months
- Kenya, Rwanda lead region in leveraging technology to revolutionise justice delivery
A source familiar with the matter, who spoke to the Nation on the condition of anonymity, revealed that BRS executives spent most of Saturday, February 1, in emergency meetings discussing the breach.
“We still can’t say who is behind the breach, but it looks like the intent is sabotage because the nature of the breach looks like there was an internal actor,” the source said as quoted by the Nation.
When approached for comment, BRS Director-General Kenneth Gathuma said he was unable to provide a statement, as he was occupied with back-to-back meetings addressing the issue.
While the identity of the attacker remains unknown, reports confirm that the stolen data is already being sold on the dark web, a platform known for illegal activities.
The BRS, one of the government’s most data-rich organisations, holds sensitive details on registered companies, their owners, directors, and beneficial owners.
Before the breach, the agency charged fees to access this information, but the attack means that even non-paying individuals now have access.
The public database through which users could access such data is currently down, prompting questions about whether the attackers were responsible for disabling it.
The BRS also manages records of companies in financial distress through the Office of the Official Receiver, with fears that this sensitive information may have been compromised as well.
Under Kenya’s data protection laws, the affected organisation must assess the extent of the breach and notify those impacted.
This breach is the first major cyberattack on a government entity in over a year, following a similar incident at Kenya Airways in late 2023 that resulted in the theft of customer data.
Sources indicate that authorities have ruled out ransomware as a motive, as there have been no demands for payment to restore the stolen data.
Top Stories Today
