Hackers breach President Ruto's official website, list demands

The official website of the President of Kenya was on Saturday compromised by hackers, with its homepage replaced by unauthorised content containing insults directed at President William Ruto and a demand for payment in Bitcoin.

A check of the presidential website, president.go.ke, showed that its usual content had been replaced with a message claiming to be from the attackers.

The hackers demanded that five Bitcoins be paid into a specified cryptocurrency wallet, warning they would release undisclosed information if the payment was not made by a stated deadline.

The message displayed on the homepage claimed the demand was the "third" warning and threatened to leak unspecified information unless the ransom was paid before 6 p.m.

State House confirmed it was aware of the cyber incident, saying its information and communications technology (ICT) team had begun working to restore the website and investigate the breach.

At current cryptocurrency prices, the five-Bitcoin ransom demanded would be worth approximately Sh41.3 million, based on a Bitcoin value of around Sh8.27 million per coin.

Although the official State House branding remained visible on the website, the homepage banner had been altered to display the hackers' message, including references to three individuals and a cryptocurrency wallet address.

It remains unclear whether the attackers only managed to deface the website's public-facing homepage or gained access to other systems linked to the presidential website.

The incident has renewed concerns over the cybersecurity of Kenya's government digital infrastructure, particularly as government websites have previously been targeted by hackers.

In November 2025, a coordinated cyberattack affected multiple government websites, including those belonging to the Ministries of Health, Education, Labour, Environment, ICT, Tourism and Interior, as well as State House.

During that incident, hackers replaced official web pages with unauthorised messages, causing disruptions to online government services and leaving several public portals inaccessible. Some of the compromised websites also displayed extremist slogans and other malicious content.

However, reports at the time indicated that the Ministry of Defence and the National Treasury were not affected by the attacks.

This latest breach comes as authorities work to determine the extent of the compromise and restore the integrity of the President's official online platform.