Kenya Restores Presidential Website After Hacker Defacement and Bitcoin Ransom Demand

Forensic teams will investigate how attackers accessed the presidential portal to determine whether a ransom was paid or sensitive information was taken.

Overview

Hackers seized control of president.go.ke, replaced the homepage with insulting messages and demanded five Bitcoins before authorities took the site offline for containment.
Government technical teams, the National Computer and Cybercrime Coordination Committee and external partners worked to restore the portal and have returned it to public access.
ICT Cabinet Secretary William Kabogo said officials have found no evidence that sensitive government data was accessed, exfiltrated or lost during the incident.
Officials have not disclosed how the attackers breached the site, whether the ransom demand was negotiated or paid, or whether a known ransomware group was responsible.
The intrusion renews scrutiny of Kenya’s public digital infrastructure after earlier government website attacks and large volumes of cyber threats reported earlier this year, which could affect how officials secure and communicate state business online.