Kenya has been digitally attacked more often, and more visibly, than almost any country in Africa. That is not an insult; it is what happens when a country moves 5,000 government services onto one portal, runs its elections on biometric databases, and builds an economy on mobile money. The same connectivity that makes Kenyan institutions modern makes them targets.
This article is the documented record. Every incident below is real, sourced, and dated, and each one ends with the part most coverage skips: how it was resolved, and what changed afterwards. If you operate infrastructure in Kenya, this is the list of things that have already happened once.
2017: the election systems and the claim that shook them
The first nationally defining cyber crisis arrived in election season. On 9 August 2017, opposition leader Raila Odinga stood before the press and declared that Kenya's election results transmission system had been hacked, saying preliminary results showing him behind President Uhuru Kenyatta were a fraud (The New York Times, 9 August 2017). The Independent Electoral and Boundaries Commission's response was immediate and specific: a hacking attempt had been made, but it did not succeed (Al Jazeera, 11 August 2017).
Two facts give that season its weight. First, on 1 August 2017, days before the vote, IEBC acting ICT director Chris Msando was tortured and killed; his murder was never solved, and it turned every technical question about the commission's systems into a question about trust (Al Jazeera, 1 August 2017). Second, on 1 September 2017, the Supreme Court annulled the presidential election, the first such ruling anywhere in Africa, citing procedural and transmission irregularities rather than a proven hack.
How it resolved: the election was rerun in October 2017, the courts never confirmed a successful breach, and no group was ever charged with one. What Kenya learned, at the cost of a constitutional crisis, was that confidence in a national system is part of its security. A system that works but cannot prove it was not tampered with fails in every way that matters.
July 2023: Anonymous Sudan takes on the whole government
The most disruptive cyberattack in Kenyan history began on 27 July 2023. A group calling itself Anonymous Sudan launched a distributed denial of service attack, a flood of junk traffic aimed at overwhelming systems, against Kenya's digital public infrastructure. The eCitizen portal, the single gateway to more than 5,000 government services, went down or degraded (BBC, 28 July 2023). The attack landed on services Kenyans depend on daily: people could not buy electricity tokens, and services tied to mobile money and government payments stalled (CIPIT Strathmore, 22 August 2023).
The government confirmed the cyberattack publicly and attributed the disruption to the DDoS technique (Anadolu Agency, 28 July 2023). Anonymous Sudan claimed responsibility and framed the attacks as retaliation for Kenya's position on the Sudan conflict, a political motive rather than a criminal one (Nigerian computer security agency advisory, July 2023; CIPIT, 22 August 2023).
How it resolved: services were restored, and the government refused the group's framing that anything had been conceded. No ransom payment was ever confirmed. The lasting effects were structural: the attacks became the reference case for Kenya's dependency on single portals, they sharpened the mandate of the national cybersecurity coordination structures, and they remain the clearest proof that availability, not data theft, is the fastest way to hurt a country.
August 2023: WorldCoin and the harvesting problem
Weeks after the DDoS crisis, a different kind of data disaster appeared, this time invited through the front door. WorldCoin, a global identity project, was collecting Kenyans' iris scans and personal data in exchange for crypto tokens. On 2 August 2023 the Office of the Data Protection Commissioner opened an investigation, and on 3 August 2023 it suspended WorldCoin's operations in Kenya (Data Guidance, 1 August 2023).
How it resolved: slowly, and with teeth. A High Court case, Republic v Tools for Humanity Corporation, ended in May 2025 with the court finding WorldCoin's activities illegal and in violation of Kenya's data protection framework (Kenya Law, 5 May 2025). In January 2026, the ODPC announced that WorldCoin had deleted the personal data collected from Kenyans in 2023. It is the country's clearest case of data harvested in bulk being forced back out again.
January 2025: the companies registry breach
The largest documented data exposure in Kenyan history hit an institution most Kenyans never think about until they need it. On the night of 31 January 2025, the Business Registration Service, the registry that holds every company's records, suffered a cyberattack that exposed private details (Nation Africa, 1 February 2025). The exposed data reportedly included confidential company ownership, directorship and beneficial owner information, and it was connected to records covering roughly two million companies (ITWeb Africa, 6 September 2026; Techpoint Africa, 3 February 2025).
How it resolved: the breach became a long-running investigation. ITWeb Africa reported in September 2026 that the probe was still active, with the data believed to have been temporarily accessible before containment (ITWeb Africa, 6 September 2026). The lesson is uncomfortable: registries are attack surfaces. A country's corporate records are an intelligence product, and whoever holds them holds a leak waiting for a port scan.
July 2026: the presidency's website, defaced for ransom
The most recent entry brought the problem to the most visible address in the country. On Saturday 18 July 2026, hackers breached president.go.ke, replaced the homepage with an anti-government message, and demanded a ransom of five Bitcoin, roughly $320,000 or Sh41 million (Anadolu Agency, 18 July 2026; Eastleigh Voice, 19 July 2026). The site was taken offline, cleaned, and restored within about two days (ITWeb Africa, 20 July 2026).
How it resolved: the ransom was not paid, the site was restored, and Kenya opened an investigation into the intrusion (The Record, 21 July 2026). A website defacement is not a database breach, but the choice of target was the point: the attackers bought national attention for the price of one compromised web server.
The backdrop: how often Kenya is actually attacked
The headline incidents sit on top of a much larger, mostly invisible volume. The national computer incident response team, KE-CIRT/CC, detects threats at national scale and publishes the numbers: over 1.1 billion cyber threat events in the second quarter of 2024, over 840 million in the fourth quarter of 2024, and roughly 842 million in the third quarter of 2025 (Communications Authority quarterly reports). The overwhelming majority are automated attempts exploiting unpatched systems, and they fail without anyone outside a security operations centre ever hearing about them.
Enforcement has matured alongside the threat. The Office of the Data Protection Commissioner issued its first penalty notices in September 2023 (Clyde & Co, 6 October 2023), had received over 7,100 complaints by March 2025, and can fine violators up to five million shillings or one percent of annual turnover. The Data Protection Act 2019 also imposes breach notification duties, which is why every incident above now has a legal tail as well as a technical one.
What the record teaches
Read together, the timeline is not random. It has a pattern that anyone running Kenyan infrastructure should memorise.
Availability is the first casualty. The two most nationally painful incidents, 2023 and 2026, were about access, not theft. Attackers who want attention attack uptime, and Kenya has proven how much downtime a country will tolerate before it becomes politics.
Registries and identity are the crown jewels. Election rolls, iris scans, corporate ownership: the same theme repeats. Data that identifies people and companies is worth more, and hurts more, than the transactional data everyone assumes is the target.
"Solved" usually means contained. With the partial exception of WorldCoin, no Kenyan incident ended with hackers caught, prosecuted and jailed. Endings look like restored services, investigations that run for years, and laws tightened afterwards. Resilience, not retribution, is the realistic goal, and it is what we design data centre security for in the first place.