Kenya has been ranked Africa’s second-most vulnerable country to cyberattacks, according to the newly released INTERPOL African Cyberthreat Assessment Report 2026. The findings show that the same digital progress that made Kenya a continental leader in mobile money and online services has also turned it into a prime target for sophisticated criminals.
East Africa has emerged as a major hub for mobile money fraud and ransomware attacks on critical infrastructure, the report states. Kenya sits at the centre of this threat.
The scale of the problem
According to the report, Kenya recorded more than 46,786 Distributed Denial-of-Service (DDoS) attacks in the first half of 2025 alone, mostly aimed at telecommunications companies. These attacks flood networks with traffic, slowing or shutting down services that millions of Kenyans rely on daily.
The report also notes that Kenya featured in top phishing detections in September 2025. Government and ICT systems faced hundreds of millions of intrusion attempts between July and September 2025, largely through brute-force attacks and exploitation of system weaknesses, according to the same assessment and data from the Communications Authority of Kenya.
The most painful impact for ordinary Kenyans has been SIM-swap fraud. According to the INTERPOL report, this type of fraud surged by 327 per cent in 2025. Criminals obtained more than 123,000 fraudulent SIM cards, used them to take over victims’ phone numbers, intercept one-time passwords and empty mobile money wallets. Losses from these attacks alone are estimated at USD 3.8 million (roughly Sh492–500 million), the report states.
A high-profile reminder of the risk came in July 2026 when hackers defaced the official presidential website, left a message directed at President William Ruto, and demanded a ransom of five bitcoins (about Sh41 million at the time). This incident has been widely reported in connection with the broader threats highlighted in the INTERPOL assessment.
Why Kenya is so exposed
INTERPOL identifies three main weaknesses; outdated systems, poor cyber hygiene and delayed software patching. The report notes that Kenya’s rapid digital transformation , especially the deep penetration of mobile money ,has outpaced the ability of many institutions and individuals to secure their systems.
Criminals are also increasingly using artificial intelligence. Across Africa, more than half (55 per cent) of reported cybercrimes are now AI-enabled, as per the report. This has allowed attackers to scale phishing, social engineering and fraud much faster.
Weak regional coordination makes the problem worse. The report warns that fraudsters exploit differences in laws and enforcement capacity between East African countries.
What this means for your M-Pesa and daily digital life
Mobile money remains the biggest everyday risk. Once a fraudster successfully swaps your SIM, they can reset passwords, approve transactions and drain accounts before you even realise your phone has lost network signal. A pattern clearly documented in the INTERPOL findings.
Businesses and government agencies face data breaches that can lead to identity theft, ransomware and larger financial fraud. Ordinary users are hit by phishing messages that look genuine , often impersonating banks, Safaricom, government agencies or popular shops.
How to protect yourself
While authorities work on stronger regional cooperation and better telecom verification (including real-time biometric checks), as recommended in the INTERPOL report, individuals can take practical steps;
- Never share one-time passwords (OTPs) or PINs with anyone.
- Enable two-factor authentication wherever possible, preferably using authenticator apps rather than SMS alone.
- Be extremely suspicious of unexpected messages asking you to click links, update details, or confirm transactions.
- Regularly check your mobile money and bank statements.
- If your phone suddenly loses network signal for no clear reason, contact your provider immediately, it could be a SIM-swap attempt.
- Keep your phone software and apps updated.
- Use strong, unique passwords and consider a password manager.
The INTERPOL African Cyberthreat Assessment Report 2026 is a clear warning. Kenya’s digital economy is a success story, but success has made it a lucrative target. Closing the gap between innovation and security through better systems, public awareness, and regional cooperation is now urgent.
Until that happens, staying alert remains the strongest defence for every Kenyan who uses M-Pesa, online banking or any digital service.
Add Comment