Hackers Take Over President Ruto’s Website and Demand Bitcoin

Hackers briefly took control of Kenyan President William Ruto’s official website on Saturday, 18 July 2026, replacing its normal homepage with hostile messages and a demand for five Bitcoin.

The affected website, president.go.ke, is the official online portal of Kenya’s presidency. It publishes presidential speeches, government announcements, photographs and information about State House activities.

What happened to President Ruto’s website?

People visiting the website on Saturday morning found that its homepage had been defaced. This means the normal content was replaced with material posted without government permission.

The attackers displayed a cryptocurrency wallet address and demanded five Bitcoin. Based on the exchange rate cited by Kenyan media on Saturday, the ransom was worth approximately KSh41.3 million, although Bitcoin’s value changes constantly.

The hackers also threatened to publish unspecified information if the government failed to pay by a stated deadline. However, they did not publicly provide verified evidence that they had obtained sensitive government files.

Kenyan government confirms cybersecurity incident

Kenya’s Cabinet Secretary for Information, Communications and the Digital Economy, William Kabogo, confirmed that cybersecurity teams were responding.

The ICT Authority activated its incident-response procedures and temporarily restricted access to the website. This allowed investigators to contain the incident, conduct a forensic examination and begin restoring the portal.

The government said preliminary investigations had found no evidence that sensitive data was accessed, removed or lost. Other government systems and digital services were said to be operating normally.

The defaced homepage was removed, and visitors later received a maintenance notice while restoration work continued. The Star

Did the hackers steal government information?

That has not been established.

Although the attackers claimed they possessed information that could be released, their claim remained unverified. A compromised public homepage does not automatically mean hackers reached confidential databases or internal government networks.

The government said a full forensic investigation was underway to determine:

• How the attackers accessed the website

• Whether the intrusion went beyond its public pages

• How long the attackers had access

• Whether any information was copied or altered

• What additional security measures are required

Authorities had not publicly identified the attackers at the time of publication.

Why the cyberattack matters

The incident raises questions about the protection of government websites as Kenya expands digital public services.

A presidential website is an important public-information platform. Even when confidential information is not stolen, temporarily taking control of such a website can spread misinformation, embarrass public institutions and weaken public confidence in government cybersecurity.

Kenya has experienced previous attacks against public websites. In November 2025, several government websites were reportedly disrupted or defaced during a coordinated cyberattack. The Standard

The latest incident is therefore likely to increase calls for stronger monitoring, regular security testing and better protection of government digital infrastructure.

Was the Bitcoin ransom paid?

There was no official evidence that Kenya had paid the ransom.

Cybersecurity authorities generally focus on containing an intrusion, protecting information, restoring systems and identifying the attackers. Paying a ransom does not guarantee that stolen information, if any exists, will be returned or deleted.

The government said restoration work and investigations were continuing. Further information is expected after the ICT Authority completes its forensic review.

This is a developing story and will be updated when Kenyan authorities release additional findings.