Kenya's Cyber Threats Surge 29% as Mobile Money Hits 54 Million
Kenya's digital economy is booming. So is the business of attacking it.
New figures from the Communications Authority of Kenya show the country recorded 11.12 billion cyber threat events in the financial year ending June 2026 . That is a 29% jump from the previous year. In the same period, mobile money subscriptions climbed to 54 million, a penetration rate of over 100% .
The two numbers tell a connected story. More money moving digitally means more reasons for criminals to try their luck.
Where the Threats Are Coming From
The bulk of the detected events, 10.64 billion, were system vulnerabilities . These are weaknesses in computer systems and networks, the kind of gaps that exist quietly until someone finds them.
Malware threats rose nearly 65% to 230 million. Brute-force attacks, where someone tries to guess a password by trying again and again, hit 132 million. DDoS attacks, which flood a service with traffic until it collapses, more than doubled to 72 million .
Web application attacks nearly doubled. Mobile application attacks grew 54% .
The Communications Authority issued 83 million cyber advisories during the year, a 60% increase. That is a lot of warnings. It suggests the threats are not just growing in number but in variety.
The Mobile Money Factor
Safaricom's M-Pesa still dominates the market with 88.8% of mobile money subscriptions . Airtel Money holds most of the rest. With 54 million subscriptions in a country of roughly 50 million people, mobile money is not a niche service. It is how Kenya pays for things.
That scale makes it a target. A single successful breach does not just cost one person. It can ripple across a network that families, businesses, and the government all rely on.
Safaricom has been tightening its defenses. It now masks phone numbers on peer-to-peer transactions, so the person who receives your money does not automatically get your number . The company says it processes 150 million transactions every day, and trust is the currency it values most .
But the company has also faced its own data challenges. A recent court judgment found that a breach involving subscriber data was systemic rather than an isolated incident, with internal communications showing data being funneled to multiple recipients over nearly a year . That case is still working its way through the courts, but it shows that even the biggest players are not immune.
What This Means for You
The 11.12 billion figure does not mean 11 billion successful attacks. The Communications Authority counts detected threat events, not confirmed breaches or financial losses . Many of those events were blocked or never amounted to anything.
Still, the trend is clear. Kenya's digital expansion is outpacing its security. Every new phone that connects to mobile money, every new business that accepts digital payments, adds another potential doorway.
For the average user, the lesson is simple. Your SIM card is more than a phone number now. It is a wallet, an identity, and a target. Treat it like one.
