Cyber threats against Kenya rise to nearly 2.7 billion in three months, regulator says
Safaricom separately says it detected 1.25 billion attempts to break into its systems in a year, and dismissed 118 staff in fraud cases.
Based on 5 sources, listed at the end of this story.
A computer keyboard. Illustration, 2025. Photo: Fredericknoronha / Wikimedia Commons, CC BY-SA 4.0, cropped
Kenya's national cyber security response centre detected nearly 2.7 billion cyber threat events between July and September, 14 percent more than in the previous three months, according to the latest quarterly report from the Communications Authority of Kenya. The centre, the National Kenya Computer Incident Response Team (National KE-CIRT/CC), is run by the authority.
Most of the events, about 2.55 billion, were attacks on systems. Brute-force attempts to guess passwords rose by 85 percent, attacks on web applications by 58 percent and malware by 20 percent. The authority blamed systems that are not kept up to date, low awareness of phishing and criminals' growing use of artificial intelligence.
The report also mentions a breach in the e-government sector earlier this year. It does not name the agency affected or say whether any personal data was exposed.
Separately, Safaricom said in its 2026 Sustainable Business Report, released on Tuesday, that it detected about 1.25 billion attempts to break into its systems in the year to March and investigated more than 130,000 security events. The report lists 118 dismissals linked to fraud cases, up from 113 the year before, and 14 cases referred to law enforcement.
"Digital trust is not an IT issue. It is a leadership issue," Safaricom chief executive Peter Ndegwa said. The authority advises organisations to update software promptly, use multi-factor authentication, manage passwords and firewalls properly and train staff to spot phishing.
