Kenya Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Kenya
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Kenya, checked 7 Nov 2026. Kenya publishes no cyber threat level and reports cyber threats detected and advisories issued in quarterly sector statistics.
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
| Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Cyber threats detected | 2,355,938,192 | April to June 2026 | Communications Authority of Kenya |
| Cyber threats detected | 11,124,632,684 (up 29.0%) | Financial year 2025/26 | Communications Authority of Kenya |
| Cyber advisories issued | 83.1 million (up 60.8%) | Financial year 2025/26 | Communications Authority of Kenya |
| DDoS attacks detected | 72,164,664 (up 114.3%) | Financial year 2025/26 | Communications Authority of Kenya |
Who is targeting it
Laws and rules this year
Full stories
Official statements
- 11 Sep 2026The Office of the Data Protection Commissioner published a draft notice adding categories of sensitive personal data under section 47 of the Data Protection Act. Office of the Data Protection Commissioner
Incidents
7 of 7 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ⚠️ ClaimedKenya National Highways Authority (KeNHA) | 25 Jul 2026 | Transport | Ransomware | Claimed. The Deadlock ransomware group listed KeNHA on its leak site. KeNHA has not commented publicly. | ransomware.live · GalaxyWarden✓ 8 Nov | |
 ✅ ConfirmedState House (Presidency) website | 18 Jul 2026 | Government | Defacement | None | Confirmed. ICT Cabinet Secretary William Kabogo confirmed the attack and said access to the presidential website was restricted for containment and forensics. He said there was no evidence of sensitive data being accessed or stolen. Claimed. The defaced homepage showed a bitcoin wallet and demanded 5 BTC, threatening to publish information about President Ruto. | The Record · Techweez✓ 8 Nov |
 ⚠️ ClaimedEast African Gasoil | 6 Jul 2026 | Energy | Ransomware | Claimed. The Arcusmedia group listed the fuel importer on its leak site. | ransomware.live✓ 8 Nov | |
| ⚠️ ClaimedBomu Hospital | 1 May 2026 | Health | Ransomware | Claimed. The Krybit group listed the Mombasa hospital on its leak site. | ransomware.live✓ 8 Nov | |
| ⚠️ ClaimedIFMIS, National Treasury | 14 Apr 2026 | Government | Data leak | Claimed. The Bashe group, also tracked as APT73, listed the Treasury's financial management system ifmis.go.ke on its leak site. Leak size is unknown. | Breachsense · ransomware.live✓ 8 Nov | |
| ⚠️ ClaimedWells Fargo Kenya (courier and security) | 6 Feb 2026 | Transport | Ransomware | Claimed. The Gentlemen ransomware group listed fargo.co.ke on its leak site. | ransomware.live✓ 8 Nov | |
 ⚠️ ClaimedNational Mining Corporation (NAMICO) | 26 Jan 2026 | Government | Ransomware | Claimed. The Tengu group listed the state mining corporation on its leak site. | ransomware.live✓ 8 Nov |
FAQ
Does Kenya have a national cyber threat level?
No published national cyber threat level was found for Kenya (checked 7 Nov 2026). Kenya publishes no cyber threat level and reports cyber threats detected and advisories issued in quarterly sector statistics.
Which organisations in Kenya confirmed cyber incidents recently?
1 incident confirmed since January 2026: State House (Presidency) website.
Which Kenya organisations appear on ransomware or leak sites?
6 claims, not confirmed by the organisations: Kenya National Highways Authority (KeNHA), East African Gasoil, Bomu Hospital, IFMIS, National Treasury, Wells Fargo Kenya (courier and security) and National Mining Corporation (NAMICO).
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.