Kenya President’s Website Breached as Hackers Demand 5 BTC Ransom

The official website of the Kenyan President William Kipchirchir Samoei Arap Ruto has been hacked, and its homepage defaced with a message targeting the President and demanding a ransom in Bitcoin ($BTC). State House confirmed the breach to the journalists, and said its Information and Communication Technology (ICT) team is managing the situation, and quickly took the website offline.

Kenya President’s Website Hit by $BTC Ransom Attack

On the morning of July 18, 2026, hackers breached the official website president.go.ke of President Ruto. Hackers defaced the homepage, replacing official content with demeaning messages directed at the President and issued a ransom demand for 5 Bitcoins.

Meanwhile, the message included a cryptocurrency wallet address for payment. If State House honours the ransom demand, the Treasury would have to part ways with approximately Ksh41,337,872.40, based on an exchange rate of roughly Ksh8,267,574.48 per $BTC.

Hackers Demand 5 $BTC Ransom, Set 6PM Payment Deadline

The hackers issued a clear extortion demand in exchange for not leaking unspecified compromising information about President William Ruto. The defaced homepage explicitly warned: “This message is the third time for you; before we leak everything about you. Do a payment of 5 bitcoins to the Bitcoin wallet…. If you want peace before 6 o’clock this evening.”

The attackers framed the demand as a final warning, implying prior unsuccessful attempts to extort or communicate with the target. They also modified the site’s banner with additional messages referencing three specific individuals, while some official State House elements remained visible.

The State House and the ICT Ministry moved quickly. Access to the website was restricted shortly after the defacement was discovered, allowing the National KE-CIRT/CC (NC4) and technical teams to contain the incident and begin restoration.

Breach Raises Government Digital Security Concerns

The latest hacking has raised questions about the security of Kenya’s government digital infrastructure, as it remains unclear whether the attack was limited to the website’s front page or extended to back-end systems. Despite previous warnings and incidents, critical public-facing government websites remain vulnerable to cyberattacks, raising concerns over the effectiveness of existing cybersecurity measures.

Meanwhile, the breach follows the hacking of websites of various ministries such as Health, Education, Labour, Environment, ICT, Tourism, Interior and State House in co-ordinated cyberattacks in November 2025. The attacks caused extensive defacements, service interruptions, and propagation of unauthorized content, presenting vulnerabilities in government portals for vital public services.

Therefore, with Kenya’s growing reliance on e-government platforms, stronger cybersecurity measures are essential to protect public trust. As restoration efforts continue and investigations proceed, the incident is expected to renew calls for increased investment in cybersecurity, regular security audits, staff training, and third-party assessments of critical government websites.