On this page
Kenya is one of the most digitally connected economies in Africa. M-Pesa, eCitizen, mobile banking and cloud services are part of daily life. That same connectivity has made the country a major target for cybercriminals, and 2026 has shown how wide the threat has become. Here is what's happening, who is being targeted, and how to protect yourself.
The scale of the problem
The numbers are very large. The national cyber response team (KE-CIRT/CC) detected 3.37 billion cyber threat events in the first quarter of 2026, a 26.15% drop from the last quarter of 2025. In the second quarter, Kenya recorded more than 2.3 billion threat events targeting internet users between April and June, according to the Communications Authority.
Falling totals don't mean Kenyans are safe. The decline doesn't mean users suffered 30% fewer successful attacks. The CA's figure counts threat activity picked up by national monitoring, and much of it is automated attempts against connected systems. The mix of attacks is also telling. About 96% of first-quarter threats were system attacks, meaning attempts to exploit weaknesses in network devices, operating systems, databases and critical infrastructure. The rest were malware, brute-force attacks, web application attacks, DDoS attacks and mobile app attacks.
International observers have noticed. INTERPOL's African Cyberthreat Assessment Report 2026 names Kenya as one of East Africa's leading targets for online criminals, and links the surge to exploitation of mobile money platforms and weak telecom security controls.
Government systems under fire
The most visible attack this year hit the country's top office. On 18 July 2026, hackers defaced president.go.ke with insults and a ransom note demanding 5 Bitcoin, about KSh 41.3 million. ICT Cabinet Secretary William Kabogo said the site was restricted for forensic analysis and that no sensitive data was compromised. The site was working normally again the next day. No group has claimed responsibility, and the government has not attributed the attack to anyone.
It followed a wave of similar incidents. Attackers and hacktivists carried out more than 120 website defacements against Kenyan domains between May 2025 and March 2026. Most exploited vulnerable CMS platforms, outdated plugins and poorly configured hosting. That included the November 2025 defacement of more than 40 government websites, which briefly disrupted public services.
Your phone number is the new front door
For ordinary Kenyans, the biggest threat is to their money. SIM-swap fraud has become one of the most damaging crimes in Kenya's mobile-first economy, because a phone number doubles as a bank username and a mobile money account. Fraudsters trick or bribe telecom agents into moving a victim's number to a new SIM. They then reset M-Pesa and banking PINs, intercept one-time passwords and empty accounts within minutes.
The losses are real. INTERPOL reports that SIM-swap fraud in Kenya rose 327% in 2025. More than 123,000 fraudulent SIMs were issued and about USD 3.8 million was drained from mobile wallets. Police have made arrests this year. In July, eight suspects were arrested in Marsabit over a SIM-swap operation that allegedly stole more than Sh1.2 million from an M-Pesa operator. Four Chinese nationals were arraigned at Kibra on September 1, 2026, in a separate SIM-swap and money-laundering case. They are presumed innocent until proven guilty.
The courts are also raising the bar for providers. In June 2026, the High Court held Safaricom and Diamond Trust Bank jointly responsible for a customer's KSh4.4 million loss after fraudsters hijacked her number. It ruled that telcos and banks each have an independent duty to protect customers from foreseeable SIM-swap fraud.
The legal landscape is shifting
Kenya's cybercrime law has been reshaped this year. In March 2026, the Court of Appeal struck down Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, which criminalised false publications. Then in July, the High Court struck down sections of the 2025 amendment that let a state committee order websites and apps blocked without court approval. These rulings don't dismantle the Act. Offences like unauthorised access to computer systems still stand.
How to protect yourself
These habits cut most of the risk for individuals:
- Watch for sudden “no network.” If your line goes dead without explanation, assume a SIM swap until proven otherwise and call your provider immediately.
- Report fast. Call Safaricom on 234, or 0722 002 234 from another network. File a police report and get an OB number. Speed matters because stolen funds move quickly.
- Guard your ID details. SIM-swap fraudsters rely on your name, ID number and phone number to impersonate you. Be careful where you share them.
- Never share PINs or OTPs, even with callers claiming to be from your bank, Safaricom or the government.
For businesses and institutions:
- Patch and update. Keep CMS platforms, plugins and hosting configurations current. These were behind most of the defacements.
- Use strong authentication. Brute-force attacks run in the tens of millions each quarter. Strong passwords and multi-factor authentication stop most of them.
- Keep offline backups and a response plan, so a ransom demand doesn't become a crisis.
The bottom line
Kenya's digital success has made it a target. The overall threat numbers are falling, but attackers are getting more targeted. They are focusing on government sites, telecom networks and the mobile money that millions rely on. The good news is that most attacks exploit basic weaknesses: an unpatched website, a leaked ID number, a PIN shared over the phone. Closing those gaps is the most effective defence you have.
