Information, Communications and the Digital Economy Cabinet Secretary William Kabogo has assured Kenyans that the country's cybersecurity agencies are responding to the cyberattack that compromised the official website of the President on Saturday 18, July 2026.
Through a tweet, Kabogo said the government agencies responsible for safeguarding Kenya's digital infrastructure are "on top of the situation" following the breach, which saw the official presidential website, president.go.ke, defaced by hackers.
His remarks come after the website's homepage was replaced with messages targeting President William Ruto, an ultimatum of up to 6:00 pm, alongside a demand for payment in Bitcoin and threats to release unspecified information if the ransom was not paid.
A spot check by The Eastleigh Voice on Saturday found that the website no longer displayed the defaced content. Instead, visitors were met with a blank white page, suggesting the site had been taken offline or was undergoing restoration as authorities worked to address the breach.
In a brief statement, State House also confirmed it was aware of the cyberattack and said its Information and Communication Technology (ICT) team was handling the matter.
Before the website was taken offline, the attackers had replaced the homepage with a message demanding payment of five Bitcoins and threatening to release unspecified information if the ransom was not paid before a stated deadline.
Based on the prevailing exchange rate at the time of the attack, meeting the ransom demand would have required approximately 5 Bitcoin ( Sh41.3 million), with one Bitcoin trading at about Sh8.27 million.
The hackers also altered the website's banner, displaying messages referencing three individuals while the official State House branding remained visible in the background.
Government officials had not, by the time of publication, indicated whether any sensitive information had been accessed or compromised during the breach. It also remains unclear whether the attack was limited to the website's public-facing homepage or extended to back-end government systems.
Cybersecurity experts note that website defacements are often designed to attract public attention by altering a website's visible pages.
However, such incidents do not automatically mean attackers have gained access to confidential government databases or internal systems. A forensic investigation is typically required to determine the full extent of a breach.
Kabogo's assurance comes amid growing concerns over cybersecurity threats targeting government institutions as Kenya continues to expand digital public services and online government platforms.
The incident has renewed questions about the resilience of government websites and the safeguards in place to protect critical digital infrastructure. As more government services migrate online, cybersecurity experts have repeatedly called for stronger security controls, continuous monitoring and regular vulnerability assessments to guard against increasingly sophisticated cyberattacks.
This is not a first
The latest incident is not the first time Kenyan government websites have been targeted.
In November 2025, several websites belonging to government ministries and state agencies, including the Ministries of Health, Education, Labour, Environment, ICT, Tourism and Interior, as well as State House, were compromised in what authorities described as a coordinated cyberattack.
The attackers defaced several government websites by replacing official content with unauthorised messages, while some government portals became temporarily inaccessible. In some cases, the affected websites displayed extremist slogans and other unauthorised content before they were restored.
The disruption affected several online services relied upon by members of the public, although the Ministry of Defence and the National Treasury were among the institutions that reportedly remained unaffected during the attack.
The recurrence of cyberattacks on government websites has intensified calls for greater investment in cybersecurity as Kenya advances its digital transformation agenda. Analysts say strengthening government cyber defences will be critical in protecting public institutions, maintaining trust in digital services and safeguarding sensitive government information.
Investigations into the latest breach are ongoing, and authorities have yet to provide a detailed technical account of how the attackers gained access to the presidential website or whether any data was compromised.
As of Saturday, the official president.go.ke website remained inaccessible, displaying only a blank white page instead of its usual content.
What will happen when they are caught?
If the hackers are identified and arrested in Kenya, they could face prosecution under several laws, primarily the Computer Misuse and Cybercrimes Act, 2018 and, depending on the circumstances, the Penal Code.
Possible charges could include:
Unauthorised access to a computer system for gaining access to the presidential website without permission.
Unauthorised interference with computer systems or data for altering the website's content.
Cyber extortion or cyber fraud, if prosecutors determine that the Bitcoin demand amounted to an attempt to extort money.
Publication of false or offensive information, if applicable under the circumstances.
Conspiracy or participation in an organised criminal group, if multiple people were involved.
If convicted, the penalties could include:
Substantial fines, which vary depending on the offence.
Imprisonment, with some offences under the Computer Misuse and Cybercrimes Act carrying prison terms of up to 10 years, particularly for serious offences involving interference with critical systems or cyber extortion.
A court may also order compensation for any losses caused by the attack, where appropriate.
Because the target was the official website of the President, investigators are also likely to treat the case as a high-priority attack on critical government infrastructure. If the perpetrators are located outside Kenya, authorities could seek international cooperation through agencies such as Interpol or work with foreign law enforcement under mutual legal assistance agreements.
It's important to note that no suspects have been publicly identified or charged in this case. Any charges and penalties would ultimately depend on the evidence gathered during the investigation and the offences that prosecutors decide to pursue.
Comments
Sign in with Google to comment, reply, and like comments.
Continue with Google