Kenya Investigates Hack of Ruto’s Official Website After Bitcoin Ransom Demand
Officials say the presidential site was defaced and briefly taken offline, but insist no data was stolen.
July 20, 2026 – 10:49 am
Image by: Republic of Kenya
Kenyan authorities are investigating a cyberattack that defaced President William Ruto’s official website over the weekend, replacing the homepage with a ransom message and a cryptocurrency wallet address. The government pulled president.go.ke offline on Saturday and has since said it found no evidence that sensitive data was taken.
The intruders demanded five bitcoins, worth roughly 41 million Kenyan shillings (about $317,000), and threatened to leak material if they were not paid by that evening, according to Kenyan outlets that saw the page before it came down. The message, addressed to Ruto, claimed it was the third such warning.
The defaced homepage, first flagged shortly after 2pm on Saturday, carried derogatory language and unspecified allegations against the president alongside the wallet address. By that point the usual presidential fare of speeches and press releases had been wiped from view.
William Kabogo, the cabinet secretary for information, communications and the digital economy, confirmed the breach on Saturday and said access to the site had been “temporarily restricted to facilitate containment, forensic analysis and restoration efforts”. He added that there was “no evidence of unauthorised access to sensitive data, data exfiltration, or loss of information”.
The National Computer and Cybercrime Coordination Committee, known as NC4, was activated to lead the response, working alongside State House technical teams and outside partners. Kabogo said government systems and digital services “remain secure and operational” and the site was restored by Sunday with its speeches, press releases and communications intact.
No group has claimed responsibility, and officials have not said how the attackers got in or whether they are treating the demand as anything more than opportunism. The identities behind the defacement remain unknown, and the government has not indicated when its forensic review will conclude.
The timing is awkward for an administration that has spent two years fielding both street protests and digital intrusions. Ruto’s government has faced sustained Gen Z-led demonstrations over taxation, the cost of living and police conduct, protests that have played out as much on social platforms as on Nairobi’s streets. Its online infrastructure has been probed repeatedly in that period, and the defacement of the head of state’s own site carries a symbolic sting the government was quick to try to contain.
In 2023, the hacktivist group Anonymous Sudan knocked out the eCitizen portal Kenyans use for thousands of government services, in a DDoS campaign that briefly disrupted everything from passport applications to mobile-money transfers. The ICT secretary at the time, Eliud Owalo, acknowledged the attack but insisted no data had been compromised.