Kenya recorded three billion cyberattacks targeting system vulnerabilities, cloud services, and government institutions over the past three months, the National Computer and Cybercrime Coordination Committee has revealed.
The NC4, which coordinates protection of Kenya’s digital infrastructure, said its latest status report shows a sharp rise in offences linked to digital payments, unauthorised system access, identity theft, online harassment, fraud, and false publication.
Nairobi logged the highest number of cases, driven by high volumes of digital transactions and the concentration of public and private institutions. Other incidents were reported across Nyanza, Eastern, Rift Valley, Central, Coast, and Western regions.
In Nairobi, the most common offences involved intentionally withholding electronic payments sent in error, unauthorised access to computer systems, computer fraud, and cyber harassment. Identity theft, impersonation, and unauthorised interference with computer systems were also widespread.
Nyanza’s leading cases were cyber harassment, identity theft and impersonation, and unauthorised access or interference with systems. The region also recorded child pornography, fraudulent use of electronic data, possession of illegal devices and access codes, and withholding electronic messages delivered erroneously.
Eastern saw computer fraud, cyber harassment, and unauthorised access with intent to commit further offences. Rift Valley reported a decline in computer fraud compared to last year but an increase in cases of withholding electronic messages sent in error, alongside cyber harassment and wrongful distribution of intimate images without consent.
Central region cases spanned child pornography, computer forgery, cyber harassment, identity theft, and non-consensual distribution of intimate images. Coast mainly reported computer fraud and cyber harassment, while Western flagged cyber harassment and unauthorised interference with systems.
Receiving the report, Interior Principal Secretary Raymond Omollo, who chairs NC4, said the findings come as Parliament approved the establishment of the National Cybersecurity Agency.
According to a special gazette notice dated May 15, 2026, President William Ruto formally created the agency as an autonomous regulatory and technical body mandated to oversee national cybersecurity matters and support the security of Kenya’s growing digital ecosystem.
“In Exercise of the powers conferred by section 3(l) of the State Corporations Act, I, William Samoei Ruto. President of the Republic of Kenya and Commander-in-Chief of the Kenya Defence Forces, makes the following Order: There is established an Agency to be known as the National Cybersecurity Agency, which shall be a body corporate with perpetual succession and a common seal,” reads the notice.
The new agency will serve as the country’s main institution for cybersecurity regulation and technical coordination. It will operate under the direction of the Cabinet Secretary responsible for internal security and will have its headquarters in Nairobi, with powers to establish satellite offices, units and operational centres where necessary.
According to the gazette notice, the agency will be responsible for formulating and overseeing the implementation of national cybersecurity strategies across both the public and private sectors.
Among its key functions will be auditing and certifying the cybersecurity resilience of designated critical information infrastructure to ensure systems remain secure and operational.
The agency will also manage the day-to-day operations of the National Cybersecurity Operations Centre while providing technical support to sector-based cybersecurity operations centres.
In addition, it will establish and maintain a Cybersecurity Centre of Excellence aimed at promoting local innovation, advanced research and development of locally developed cyber defence tools.
The agency has further been tasked with carrying out regular technical assessments of government and private sector digital networks to identify weaknesses and ensure compliance with cybersecurity standards.
Other responsibilities include deploying advanced analytical and forensic tools to detect emerging digital threats and issuing technical advisories to relevant stakeholders.
To address the country’s cybersecurity skills gap, the agency will develop specialised professional certification programmes and technical training courses.
It will also serve as the lead technical link between government and industry groups to help align cybersecurity practices across different sectors of the economy.
“Serve as the lead technical liaison between the government and industry consortia to harmonise cybersecurity practices within specific economic sectors,” reads the notice.
The agency will also be responsible for formulating and enforcing technical and administrative guidelines aimed at reducing the impact of malicious software, unauthorised network intrusions and large-scale digital disruptions.
At the international level, it will participate in global cybersecurity forums and work with peer institutions to facilitate the exchange of threat information and best practices.
The Ministry of Interior welcomed Parliament’s approval of the order, describing the move as a major step towards strengthening Kenya’s ability to protect its expanding digital economy.
It noted that the establishment of the agency comes at a time when Kenya continues to experience rapid growth in mobile money services, digital financial platforms, e-government systems, telecommunications, health information systems, education technology and online commerce.
While these developments have created new opportunities for innovation, investment and service delivery, the Ministry said they have also exposed public and private sector systems to increasing cyber threats.
“Cybercrime, ransomware attacks, online fraud, identity theft, malicious software, data breaches, misinformation campaigns and attacks on critical digital infrastructure continue to pose growing risks to national security, economic stability and public confidence in digital services,” it said.
“As government institutions, businesses and citizens become increasingly reliant on digital technologies, strengthening cybersecurity has become a national priority.”
To support coordination across government, the agency’s board will include representatives from Internal Security, the National Treasury, Information, Communications and the Digital Economy, the Office of the Attorney General, the Kenya Defence Forces, the National Police Service, the National Intelligence Service and the Office of the Director of Public Prosecutions, alongside representatives from academia and the private sector.
The order further requires the agency to prepare annual revenue and expenditure estimates, maintain proper financial records and submit annual reports on its operations to the Cabinet Secretary. Its accounts will also be audited in line with the Public Finance Management Act and the Public Audit Act.
