Kenya probes Ruto website hack as attackers demand 5 Bitcoin ransom

Hackers breached the official website of Kenyan President William Ruto on July 18, replacing its homepage with a ransom message demanding 5 Bitcoin — worth about $320,000 at current prices — and threatening to leak unspecified data if the payment was not made.

The attack targeted president.go.ke, the presidency's primary digital portal, according to local media reports. The defaced page carried messages criticizing Ruto alongside a Bitcoin wallet address and a deadline of 6 p.m. local time for the ransom to be paid.

Information, Communications and the Digital Economy Cabinet Secretary William Kabogo confirmed the breach in a statement, saying government cybersecurity teams had activated their response procedures.

"Our cyber team is on top of the situation," Kabogo said, adding that the ICT Authority had taken the website offline to allow forensic investigators to assess the extent of the intrusion.

State House separately confirmed that its ICT team was working to contain the breach and restore access. Officials said there was no evidence that sensitive government data had been accessed, copied or removed, and that other state-run digital services remained operational.

The attackers claimed the defacement was their third warning, though no earlier public threats had been reported. By Saturday afternoon, the website remained inaccessible, displaying an error message instead of the usual homepage.

The incident follows a broader cyberattack in November 2025 that hit multiple Kenyan government websites, including those of the Health, Education, Labor, Environment, ICT, Tourism and Interior ministries, as well as State House platforms. Some pages were defaced with extremist content. The Ministry of Defence and National Treasury were among the few institutions unaffected in that attack.

Kenya has faced growing cybersecurity challenges as it accelerates its digital government agenda. The country's push for online public services — from tax filing to business registration — has expanded the attack surface for state-run portals. The ICT Authority said it was working with external technical experts to determine how the hackers gained access and whether the breach extended beyond the public-facing homepage into back-end systems.

The ransom demand places Bitcoin at the center of a high-profile cybercrime incident, a dynamic that has historically drawn regulatory scrutiny in jurisdictions where cryptocurrency anonymity is viewed as an enabler of illicit finance. Kenya's Capital Markets Authority has been exploring a regulatory framework for digital assets since 2022, though comprehensive crypto legislation has yet to be enacted.

Bitcoin traded at $63,999.11 at the time of the breach, up 1.39% over the prior 24 hours, according to CoinGecko data. The incident had no visible impact on the cryptocurrency's market performance.

Authorities have not indicated whether ransom negotiations will take place. Investigators continue examining the breach while cybersecurity teams work to restore the presidential website.

This article is for informational purposes only and does not constitute investment advice.