President William Ruto's official website, president.go.ke, was down on Saturday after hackers allegedly took control of the homepage and replaced it with a ransom message.
Users attempting to access the site were met with an error message, with the portal remaining unreachable hours after the breach was first noticed.
A spot check on the website showed the homepage had been defaced with messages targeting Ruto directly, alongside a cryptocurrency wallet address and a demand for 5 bitcoins.
The attackers threatened to leak unspecified information about the president if the payment was not made by 6 pm the same day.
The defaced page read in part that the hackers would "do a payment of 5 bitcoins to the Bitcoin wallet" before releasing what they claimed was compromising material.
Based on Saturday's exchange rate of about Sh8.27 million per bitcoin, the ransom amounts to roughly Sh41.3 million.
State House confirmed the breach in a statement, saying its Information and Communications Technology (ICT) team was working to restore the site and investigate how the attackers gained access.
Officials did not say whether the intrusion reached beyond the homepage into back-end government systems.
ICT Cabinet Secretary William Kabogo weighed in on X on Saturday, saying the responsible agencies were on top of the matter.
“The responsible Agencies that protect websites are on top of stuff,” Kabogo said on X.
The hack is the second to hit president.go.ke in under a year.
In November 2025, a coordinated cyberattack knocked out several government websites, including those of the Interior, Health, Education and ICT ministries, with attackers defacing pages with extremist slogans.
