Kenya probes hack of president's website after bitcoin ransom demand

Kenya is investigating a cyberattack that temporarily defaced the president's official website with an anti-government message demanding a ransom of five bitcoins (about $330,000).

The website was hacked on Saturday, when its homepage was replaced with a message displaying a cryptocurrency wallet address and threatening to publish unspecified information about President William Ruto unless the ransom was paid.

By Monday, access to the website had been restored, according to local media. The identity of the attackers remains unknown, and there is no evidence they possess or have leaked any sensitive government information.

Information, Communications and the Digital Economy Cabinet Secretary William Kabogo confirmed the cyberattack over the weekend, saying government cybersecurity teams were investigating the incident.

"As a precautionary measure, access to the Presidential website was temporarily restricted to facilitate containment, forensic analysis and restoration efforts," Kabogo said in a statement.

He said authorities had found no evidence of unauthorized access to sensitive data, data exfiltration, or loss of information, adding that government systems and digital services remained secure and operational.

Screenshots of the defaced website shared on social media showed the attackers claiming the message was their "third" warning to the president before threatening to release data. Authorities have not confirmed that claim, and no verified data leak has been made public.

This is not the first cyber incident involving Kenyan government websites.

In November 2025, a coordinated cyberattack temporarily disrupted multiple government websites, including those of the presidency and the ministries responsible for interior, health, education, energy, labor, and water. The attackers defaced several ministry websites with white supremacist slogans, including "We will rise again," "White power worldwide," and "14:88 Heil Hitler."