By the 254.ke Newsroom.
Kenya recorded about 2.6 billion cyber threat events between July and September 2026, a 14.45 per cent rise from the previous quarter, the Communications Authority of Kenya (CA) said in its latest cybersecurity report. The regulator blamed outdated systems, low public awareness of phishing and criminals’ growing use of artificial intelligence.
The figures were published on October 27, 2026. They count detected threat events, not confirmed successful breaches.
How many cyber attacks did Kenya record in Q3 2026?
According to Capital FM’s report on the CA data, system attacks made up the overwhelming share of the total. Other categories were far smaller.
| Threat type (Jul-Sep 2026) | Events recorded |
|---|---|
| System attacks | 2.55 billion |
| Malware | 8.37 million |
| Brute-force attacks | 916,418 |
| Web attacks | 549,931 |
| Mobile application attacks | 18,837 |
| Distributed denial-of-service (DDoS) | 13,201 |
Not every outlet reports the same breakdown. Techweez, citing the same CA report, puts the quarterly total at almost 2.7 billion and gives different category figures, including 70.8 million malware events and 44.9 million brute-force events. The two accounts agree on the 14.45 per cent quarterly increase. This article uses the Capital FM breakdown and will be updated if the CA publishes a clarification.
The National Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC) issued 20.3 million cyber threat advisories over the period, a 2.36 per cent drop from April to June.
What is behind the rise?
The CA named three causes:
- Inadequate system updates, which leave known weaknesses open.
- Limited public awareness of phishing and other social engineering tricks.
- Attackers using artificial intelligence to make their attacks more convincing.
Did the report confirm a government cyber breach?
Yes, in part. The report acknowledges a breach in the e-government sector earlier in the year but does not name the agency, according to Techweez and Kenya Today. The CA has not said how attackers got in, whether personal data was taken, or how many people were affected.
The reference comes from a summary of the 56th meeting of the National KE-CIRT/CC Cybersecurity Committee, held in Nairobi on September 23, 2026. At that meeting the e-government sector called for stronger protection of information assets and said it was working to meet audit requirements from the Office of the Data Protection Commissioner.
On July 18, 2026, the Ministry of Information, Communications and the Digital Economy said the ICT Authority had detected a cybersecurity incident on the presidential website, restricted access and begun forensic investigations. It reported no evidence of data theft at that stage. The CA report does not link that incident to the e-government breach, and neither does this article.
How does the private sector compare?
Safaricom said in its FY26 sustainability report, launched the same day in Nairobi, that it detected and monitored about 1.25 billion intrusion attempts and investigated more than 130,000 security events during its financial year, according to TechTrends Kenya. Chief executive Peter Ndegwa described data protection, secure transactions and AI governance as main priorities.
How can Kenyans and businesses protect themselves?
The CA’s advice to organisations is to update systems and applications promptly, switch on multi-factor authentication, manage passwords properly, configure firewalls and antivirus correctly, and train users to spot phishing.
For individuals, the same logic applies: keep phones and apps updated, never share M-PESA PINs or one-time codes, and treat unexpected links as suspect. Our earlier explainer on how SIM-swap fraud works covers a common scam, and our report on inactive SIM card rules explains what happens to dormant lines. The country’s growing computing capacity is covered in Nairobi’s 2026 data centre boom.
Kenyans can report incidents to the national response team through the Communications Authority of Kenya.
FAQ
Does 2.6 billion threat events mean 2.6 billion successful hacks?
No. The figure counts detected attempts and suspicious events, most of them automated probes. Only a small fraction would be successful intrusions.
Which agency was breached?
The CA report does not say. It refers only to an e-government sector breach earlier in 2026.
Was personal data stolen?
That has not been disclosed. The CA has not said whether personal data was involved.
What is KE-CIRT/CC?
It is Kenya’s national computer incident response coordination centre, which issues threat advisories and coordinates responses to incidents.
Sources: Capital FM via allAfrica (Oct 27, 2026); Techweez (Oct 26, 2026); Kenya Today; TechTrends Kenya (Oct 27, 2026).
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
site-verification-ok
