Kenya investigates cyber incident affecting president’s website

Kenya’s Ministry of Information, Communications and the Digital Economy said it was investigating a cybersecurity incident that affected the official website of President William Ruto. The case quickly widened beyond a single page, with other Kenyan coverage describing disruption at several government sites linked to ministries and state agencies.

Officials said so far there was no evidence of unauthorized access to sensitive data or loss of information. That distinction matters in a country where a presidential website is not just a communications channel but a symbol of state authority, and where even a short disruption can raise questions about whether official announcements are secure and authentic.

The affected sites were reported to include Health, Education, Labour, Environment, ICT, Tourism, State House and Interior, suggesting the incident was not confined to one office. Some reports said most of the affected websites were later restored, and the government said it had taken control of the situation. Even if the event turned out to be limited to defacement or a temporary outage, the episode exposed how quickly a public-facing government platform can become a national security concern.

That is especially sensitive in Kenya, where a previous breach in 2025 was described as hackers diverting domain names before access was restored. The pattern points to a familiar weakness across public sector systems: websites built for reach and visibility are often the easiest targets, and the damage is not limited to stolen data. A takeover or defacement can interrupt services, confuse citizens, and erode confidence in the authenticity of government information.

The investigation also lands in a charged policy environment. Reuters reported in 2025 that President William Ruto signed a cybercrimes law opposed by media rights groups, a reminder that Kenya’s digital security agenda has already faced scrutiny over how much power the state should have online. With government websites increasingly used to deliver announcements, policy updates and contact information, the current incident is likely to intensify scrutiny of password controls, hosting arrangements, vendor oversight and incident response across the public sector.

Even without confirmed data exfiltration, the breach of a symbolic platform has already done one kind of damage: it has forced the government to prove that its most visible digital front door is not also one of its weakest links.