CA Confirms Government Cyber Breach Without Naming Agency

Kenya’s cybersecurity authorities have acknowledged a breach in the e-government sector earlier this year.

However, the Communications Authority of Kenya‘s (CA) latest quarterly report does not say which system was hit, how attackers got in, or whether personal data was exposed.

The reference is based on the released CA’s Cybersecurity Report, 43rd Edition, covering July to September 2026, in a summary of the 56th meeting of the National KE-CIRT/CC Cybersecurity Committee, held in Nairobi on September 23.

The committee brings together more than 50 public and private organizations protecting critical information infrastructure.

At the meeting, the e-government sector called for stronger protection of information assets and a more proactive approach to data security after the breach, while working to meet audit requirements raised by the Office of the Data Protection Commissioner (ODPC).

The report does not name the affected agency, explain how attackers got in, say whether data was accessed or removed, or give the number of people affected or the steps taken to contain the incident.

The only timing clue is that the breach came earlier in the year, so it may predate the quarter covered.

The CA report does not link the breach to the president’s website, but the timing makes the July incident the nearest public match.

On July 18, the Ministry of Information, Communications, and the Digital Economy said the ICT Authority had detected a cybersecurity incident on the site, activated response protocols, and restricted access to contain it and allow forensic investigations.

The ministry said it had found no evidence at that stage of unauthorized access to sensitive data, data theft, or information loss, and that the site was being restored.

The CA report did not mention whether this breach was discussed at the committee, but it is an indicator that high-level government systems are a target for cyber threats.

The report recorded a rise in cyber threats over the quarter, with the National KE-CIRT/CC detecting almost 2.7 billion threat events, a 14.45% increase from April to June.

Government systems appear among the main targets in four of the report’s six cyberattack categories.

These include malware (up 20.01% to 70.8 million attempts), web applications (up 57.62% to 27.4 million), brute force attacks (up 85.41% to 44.9 million), and denial-of-service attacks, which flood services with traffic (down 97.18% to 23,124).

The report attributes the rise largely to inadequate patching, low awareness of phishing, and attackers’ growing use of AI.

In the brute-force category, the report says successful compromises, largely attributed to vulnerable databases, weak authentication, and insecure remote desktop settings, gave attackers access to critical systems and exposed sensitive information.

However, it provides no figures and does not link these incidents to the e-government breach.

Attack Category	Attempts	What It Means	Key Vulnerabilities & Contributing Factors
Malware	70.8 Million	Malicicyber ous software designed to infiltrate, damage, or compromise systems.	• Inadequate / delayed software patching • Low awareness of phishing scams • Threat actors increasingly leveraging AI
Web Applications	27.4 Million	Attacks targeting public portals, online services, and web infrastructure.	• Outdated software and unpatched flaws • Attackers using automated tools and AI
Brute Force	44.9 Million	Automated, high-speed guessing of credentials/passwords to force entry.	• Weak authentication (lack of MFA) • Vulnerable databases • Insecure remote desktop (RDP) settings (Led to confirmed compromises & exposed sensitive data)
Denial-of-Service (DoS)	23,124	Flooding online services with artificial traffic to knock them offline.	• Service availability and bandwidth saturation

The totals count detected events rather than confirmed breaches, and the report recommends timely software updates, multi-factor authentication, well-managed firewalls, and better incident response, alongside closer information sharing.

The report acknowledges a breach but offers too little to judge its severity or whether the response was adequate.

Still unanswered are which agency was affected, what the investigation found, whether personal data was involved, whether the ODPC audit requirements arose from the breach, and which corrective measures are complete.

With more public services moving online, a fuller account would show how government institutions protect data and respond when security fails.