Hackers briefly took control of Kenyan President William Ruto’s official website on Saturday, 18 July 2026, replacing its normal homepage with hostile messages and a demand for five Bitcoin.
The affected website, president.go.ke, is the official online portal of Kenya’s presidency. It publishes presidential speeches, government announcements, photographs and information about State House activities.
What happened to President Ruto’s website?
People visiting the website on Saturday morning found that its homepage had been defaced. This means the normal content was replaced with material posted without government permission.
The attackers displayed a cryptocurrency wallet address and demanded five Bitcoin. Based on the exchange rate cited by Kenyan media on Saturday, the ransom was worth approximately KSh41.3 million, although Bitcoin’s value changes constantly.
The hackers also threatened to publish unspecified information if the government failed to pay by a stated deadline. However, they did not publicly provide verified evidence that they had obtained sensitive government files.
Kenyan government confirms cybersecurity incident
Kenya’s Cabinet Secretary for Information, Communications and the Digital Economy, William Kabogo, confirmed that cybersecurity teams were responding.
The ICT Authority activated its incident-response procedures and temporarily restricted access to the website. This allowed investigators to contain the incident, conduct a forensic examination and begin restoring the portal.
The government said preliminary investigations had found no evidence that sensitive data was accessed, removed or lost. Other government systems and digital services were said to be operating normally.
CYBERCRIME
Hackers Take Over President Ruto’s Website and Demand Bitcoin
Jul 18, 2026
Jul 18, 2026
4 min read
Published
Updated:
Hackers briefly took control of Kenyan President William Ruto’s official website on Saturday, 18 July 2026, replacing its normal homepage with hostile messages and a demand for five Bitcoin.
The affected website, president.go.ke, is the official online portal of Kenya’s presidency. It publishes presidential speeches, government announcements, photographs and information about State House activities.
What happened to President Ruto’s website?
People visiting the website on Saturday morning found that its homepage had been defaced. This means the normal content was replaced with material posted without government permission.
The attackers displayed a cryptocurrency wallet address and demanded five Bitcoin. Based on the exchange rate cited by Kenyan media on Saturday, the ransom was worth approximately KSh41.3 million, although Bitcoin’s value changes constantly.
The hackers also threatened to publish unspecified information if the government failed to pay by a stated deadline. However, they did not publicly provide verified evidence that they had obtained sensitive government files.
ADVERTISEMENT
Kenyan government confirms cybersecurity incident
Kenya’s Cabinet Secretary for Information, Communications and the Digital Economy, William Kabogo, confirmed that cybersecurity teams were responding.
The ICT Authority activated its incident-response procedures and temporarily restricted access to the website. This allowed investigators to contain the incident, conduct a forensic examination and begin restoring the portal.
The government said preliminary investigations had found no evidence that sensitive data was accessed, removed or lost. Other government systems and digital services were said to be operating normally.
The defaced homepage was removed, and visitors later received a maintenance notice while restoration work continued. The Star
Did the hackers steal government information?
That has not been established.
Although the attackers claimed they possessed information that could be released, their claim remained unverified. A compromised public homepage does not automatically mean hackers reached confidential databases or internal government networks.
ADVERTISEMENT
The government said a full forensic investigation was underway to determine:
How the attackers accessed the website
Whether the intrusion went beyond its public pages
How long the attackers had access
Whether any information was copied or altered
What additional security measures are required
Authorities had not publicly identified the attackers at the time of publication.
Why the cyberattack matters
The incident raises questions about the protection of government websites as Kenya expands digital public services.
A presidential website is an important public-information platform. Even when confidential information is not stolen, temporarily taking control of such a website can spread misinformation, embarrass public institutions and weaken public confidence in government cybersecurity.
Kenya has experienced previous attacks against public websites. In November 2025, several government websites were reportedly disrupted or defaced during a coordinated cyberattack. The Standard
ADVERTISEMENT
TRENDING NOW
POPULAR TODAY
The latest incident is therefore likely to increase calls for stronger monitoring, regular security testing and better protection of government digital infrastructure.
Was the Bitcoin ransom paid?
There was no official evidence that Kenya had paid the ransom.
Cybersecurity authorities generally focus on containing an intrusion, protecting information, restoring systems and identifying the attackers. Paying a ransom does not guarantee that stolen information, if any exists, will be returned or deleted.
The government said restoration work and investigations were continuing. Further information is expected after the ICT Authority completes its forensic review.
This is a developing story and will be updated when Kenyan authorities release additional findings.
ADVERTISEMENT
RELATED ARTICLE
