Kenyan gov’t websites back online after hackers deface pages with white supremacist messages

The government of Kenya suffered a cyberattack on Monday morning that defaced multiple ministry pages with racist messages for several hours. 

The hackers behind the attack replaced ministry websites with white supremacist messages like “We will rise again,” “White power worldwide” and “14:88 Heil Hitler.”

The websites for the ministries of interior, health, education, energy, labour and water were taken over by the hackers alongside several other government-affiliated platforms. 

Kenya’s Interior Ministry published a notice confirming the incident and saying several government websites were rendered temporarily inaccessible due to the attack. 

“Preliminary investigations indicate that the attack is suspected to have been carried out by a group identifying itself as ‘PCP@Kenya’. Following the incident, we immediately activated our incident response and recovery procedures, working closely with relevant stakeholders to mitigate the impact and restore access to the affected platforms,” the government explained. 

“The situation has since been contained, and the systems are under continuous monitoring.”

The Interior Ministry urged citizens to contact the country’s incident response team (National KE-CIRT) if they have any information about the cyberattack. 

The incident took place one day after Somalia, which shares a border with Kenya, reported a cyberattack on its Immigration and Citizenship Agency. 

The government said it detected a breach of data belonging to people who had traveled to Somalia through e-Visas. The agency is now investigating the incident and is trying to determine how many people were impacted.  

The U.S. Embassy in Somalia said the notice relates to allegations that emerged on November 11, when hackers claimed to have penetrated the country’s e-visa system and potentially exposed “the personal data of at least 35,000 people, including possibly thousands of U.S. citizens.” 

“Leaked data from the breach included visa applicants’ names, photos, dates and places of birth, email addresses, marital status, and home addresses,” the embassy said. “While Embassy Mogadishu is unable to confirm whether an individual’s data is part of the breach, individuals who have applied for a Somali e-visa may be affected.”

No hacking group has taken credit for either incident as of Monday afternoon.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Logitech discloses data breach after Clop claims

Next Post

Princeton University says database containing donor, alumni info breached

Related Posts

ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access

A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad. "The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access," AhnLab Security Intelligence Center (ASEC) said in a report published last week. "They then used PowerCat, an open-source
Read More

The AI SOC Stack of 2026: What Sets Top-Tier Platforms Apart?

The SOC of 2026 will no longer be a human-only battlefield. As organizations scale and threats evolve in sophistication and velocity, a new generation of AI-powered agents is reshaping how Security Operations Centers (SOCs) detect, respond, and adapt. But not all AI SOC platforms are created equal. From prompt-dependent copilots to autonomous, multi-agent systems, the current market offers
Read More

Newly Patched Critical Microsoft WSUS Flaw Comes Under Active Exploitation

Microsoft on Thursday released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with a proof-of-concept (Poc) exploit publicly available and has come under active exploitation in the wild. The vulnerability in question is CVE-2025-59287 (CVSS score: 9.8), a remote code execution flaw in WSUS that was originally fixed by the tech giant
Read More