Kenya restores President Ruto’s website after hackers demand 5 Bitcoin ransom

Kenya restored President William Ruto’s official website on Sunday, following an attack from unknown hackers who hacked and defaced its homepage, demanding a ransom of 5 Bitcoin, and threatening to leak alleged stolen files if payment was not made. 

Visitors to president.go.ke on Saturday were met with a cryptocurrency wallet address, insulting messages directed at the president, and a countdown timer instead of the usual speeches and official announcements.

Hackers demand millions in Bitcoin

The attackers demanded five Bitcoin tokens, worth around 41 million Kenyan shillings (roughly $320,000) in total, and gave the government until 6 p.m. on Saturday to pay; otherwise, they would release stolen sensitive files. 

Furthermore, previous attempts made by the attackers to reach the government were ignored. The message: “This message is the third time for you; before we leak everything about you,” was the last thing on the page at the time it was taken down. 

So far, authorities have refused to disclose how the attack occurred or whether it went beyond defacing the website’s homepage.

Government restores website

Kenya’s Ministry of Information, Communications, and the Digital Economy said the breach was detected shortly after it occurred, and the page was swiftly restricted from public access while forensic investigations began. 

Cabinet Secretary William Kabogo Gitau also stated that investigators found no evidence of hackers gaining unauthorized access to sensitive government data, downloading data, or causing information loss, stating that the government’s digital services remained safe, secure, and operational.

The investigation is being carried out by the National Computer and Cybercrime Coordination Committee (NC4), along with the State House technical teams and external cybersecurity partners. 

The presidential website mainly serves as an information portal for citizens to read official speeches, presidential engagements, and executive communications to the general public, meaning the homepage defacement on its own does not indicate that government systems were also accessed.

Kenya’s cyberattacks continue to rise

The latest incident comes less than a year after a couple of Kenyan government websites, including those belonging to the president and other government bodies such as the ministries of Interior, Health, Education, Labor, and Energy, were temporarily knocked offline during a coordinated cyberattack. 

These attacks, according to the government, were carried out by a group known as PCP@Kenya, after which the government pledged to strengthen its cybersecurity defenses. 

Before that, Kenya had previously experienced a major cyber incident in 2023 when a distributed denial-of-service (DDoS) attack prevented millions of citizens from accessing the eCitizen platform, which grants them access to public services.

The number of attacks within the country has been on the rise recently, with over three billion attempted cyberattacks targeting government systems, cloud infrastructures, and critical government services over a three-month period, with Nairobi suffering the highest number of reported incidents nationwide.

The breach also comes as Kenya takes steps to strengthen its cyber defenses with its newly approved National Cybersecurity Agency, which will serve as the country’s central body for enforcing cybersecurity policies and incident response.

Although the presidential website has since been restored, investigators are still working to determine how the attackers gained access and whether the incident extended beyond the site’s public-facing pages. The findings could shape Kenya’s next steps under its Computer Misuse and Cybercrimes Act.