IFMIS 'Bashe' claim and the discipline of saying only what's proven

status: 🟡 UNVERIFIED CLAIM official: no confirmation or denial on record. last-checked: 2026-08-27

This post states only what’s proven. If the Treasury, ODPC, or KE-CIRT/CC confirms or denies the claim — or a verifiable dataset surfaces — this line and the attribution notes get updated to match.

On 13 April 2026, the ransomware group APT73 — better known as Bashe — added an entry to its dark web leak site: ifmis.go.ke, Kenya’s Integrated Financial Management Information System, the National Treasury’s spine for public spending. A countdown, a demand, the usual choreography.

And then the internet did what it does: dozens of aggregators and a few headlines converted a leak-site listing into a reported breach of Kenya’s government finance system. That conversion is the actual subject of this post. Because on the evidence available, “IFMIS was breached” is a claim, not a fact — and the group making it has a long, documented history of claims that don’t survive scrutiny.

Publication note. This piece reports on a security incident in the public interest. It processes no personal data of any data subject, reproduces no stolen or leaked records, and links to no leak-site or hostile infrastructure. It is written to stay within Kenya’s Data Protection Act, 2019 and the Computer Misuse and Cybercrimes Act, 2018. It is not legal advice. More on the legal frame below — it’s part of the story, not a footnote.Sources (defanged)

What IFMIS is, and why the target matters

IFMIS is the platform the National Treasury uses to run public financial management — budgeting, procurement, expenditure, and reporting — across national and county government. In plain terms, it’s where a large share of how the Kenyan state spends money is planned, authorised, and recorded. That makes it exactly the kind of target whose name on a leak site generates a headline before anyone checks whether the claim holds, and exactly the kind of system where a real compromise would matter enormously.

Both of those things are true at once. The stakes are why the claim is newsworthy. The stakes are also why it must not be overstated. High consequence is a reason for more verification discipline, not less.

It’s not a system without history, either — which is part of why a claim against it lands so readily.

A 2016 insider attempt to manipulate IFMIS payments was detected and stopped. In 2019 the portal was defaced by a group calling itself the Kurd Electronic Team. In 2024 the US Trade Representative’s office publicly flagged IFMIS as vulnerable to manipulation and hacking. So the ground was primed: a claim against IFMIS fits a pre-existing story, and stories that fit are the ones people forward without checking. (Note the two big 2023 and 2025 Kenyan government cyber incidents — Anonymous Sudan and “PCP@Kenya” — hit other state platforms; neither was an IFMIS compromise, and conflating them would be its own error.)

What Bashe actually claimed

Stated precisely, and no further than the evidence goes:

• Who: APT73, operating as Bashe (previously seen under the name Eraleign) — a double-extortion ransomware-as-a-service operation. Affiliates breach; a core team runs the leak site and malware; proceeds are split.
• What: a leak-site listing for ifmis.go.ke posted on 13 April 2026, with an extortion notice threatening to release data unless negotiations began.
• How much: unknown. Trackers that mirror the listing record the leak size as unknown, and I’ve seen no published dataset accompanying the claim.
• Corroboration: none independent. What exists is the group’s own posting, re-indexed across breach-tracking sites. A re-indexed claim is still one claim.

That is the whole of what’s actually established. Everything beyond it — what was taken, whether anything was taken, how deep the access went — is, at time of writing, unproven.

The credibility problem

This is the part the aggregators skip, and it’s the most important part. Bashe is not a source you extend the benefit of the doubt to.

• In January 2025, CloudSEK assessed that Bashe appeared to be fabricating some breach claims and repackaging old data as fresh breaches — building a reputation on the appearance of activity rather than demonstrated intrusions.
• In early 2026, DataBreaches.net and SuspectFile separately tried to verify Bashe claims and hit the same wall: no verifiable evidence provided, and an offer to “prove” authenticity only if the journalist purchased the stolen data — which no ethical researcher does, and which doesn’t establish authorship anyway.
• Also in April 2026, one of the UK’s largest investment platforms, Hargreaves Lansdown, flatly denied a 50GB Bashe claim against it.

Put together, that’s a track record of a group whose listings cannot be taken at face value. It doesn’t prove the IFMIS claim is false — a broken clock and all that — but it sets the prior firmly at unverified, and it means the burden of proof sits with the claim, not with the doubt. House rule around here: evidence over vibes. A leak-site banner is a vibe until a verifiable dataset or an official confirmation makes it evidence.

What was exposed — and why I won’t pretend to know

The honest answer is: on public evidence, unknown. No dataset has surfaced that I can point to; the leak size is unrecorded; there’s no confirmation from the National Treasury that data was exfiltrated.

I could pad this section by describing, in vivid detail, the categories of sensitive information IFMIS processes — supplier and procurement records, payment and expenditure data, and so on — and let the reader infer a catastrophe. I’m not going to, because that’s a rhetorical trick: describing what a system holds is not evidence of what was taken, and dressing speculation in specifics is how unverified claims get laundered into “facts.” If a verifiable dataset appears, or an authority confirms scope, this section gets updated with what’s actually shown. Until then, “unknown” is the complete and correct answer.

What Kenyan authorities said

Here I have to be equally disciplined about a gap. As of writing, I have found no verified public statement from the National Treasury or the Office of the Data Protection Commissioner (ODPC) specifically addressing this Bashe listing — no confirmation, and no on-record denial. Absence of a statement is not evidence either way; it’s just the current state of the public record, and I’d rather say that plainly than manufacture a quote.

What can be described accurately is how Kenya’s incident machinery is built to respond, from its conduct in other recent incidents:

• National KE-CIRT/CC — the national Computer Incident Response Team coordination centre — is the operational first responder for cyber incidents.
• The National Computer and Cybercrimes Coordination Committee (NC4), chaired by Interior Principal Secretary Raymond Omollo, coordinates the multi-agency response.
• In the November 2025 “PCP@Kenya” defacement wave against other state sites, the government’s pattern was: activate a multi-agency response team, contain, restore, and publicly frame the attacks as violations of the Computer Misuse and Cybercrimes Act, the Kenya Information and Communications Act, and the Data Protection Act.

That is the template a serious IFMIS incident would be expected to run through. Whether it was triggered here, and to what extent, is not something I can confirm from public sources — so I don’t.

The legal frame this is published under

Reporting on a Kenyan government breach from Kenya means the publication itself has to be lawful. Two statutes set the boundaries, and they’re worth understanding as a researcher, not just obeying:

Data Protection Act, 2019. It governs the processing of personal data of people in Kenya and is enforced by the ODPC. For a data controller — here, the relevant government body — a personal-data breach triggers a duty to notify the Data Commissioner without undue delay, in practice within 72 hours where feasible, and to inform affected data subjects where the breach poses a real risk to their rights. For me, publishing about it, the Act is the reason this post carries no personal data and reproduces no records: journalism and research in the public interest have latitude under the Act, but that latitude is not a license to re-publish victims’ personal information. The cleanest way to stay compliant is to process none of it — so I don’t.

Computer Misuse and Cybercrimes Act, 2018. It criminalises unauthorised access and interference — which is why no researcher should be accessing claimed IFMIS data to “verify” it — and it contains provisions on the publication of false information, which is a second, independent reason to state this claim as a claim rather than assert a breach as fact. Defanging every reference and never linking hostile infrastructure isn’t just house style; it’s staying clear of facilitation.

The through-line: the same verification discipline that makes this good journalism also keeps it inside the law. Those aren’t two competing constraints. They’re the same constraint wearing different hats.

If you’re a supplier or civil servant

Measured, not alarmist — because nothing here is confirmed:

• There is no verified evidence your IFMIS-linked data was exposed. Don’t panic; don’t ignore it either.
• Ordinary hygiene is always reasonable: strong, unique credentials, MFA where offered, and scepticism toward any “IFMIS/Treasury” message asking you to log in, pay, or confirm details — extortion claims are followed by opportunists running phishing off the headlines.
• If you have a specific concern about your personal data held by a government body, the ODPC is the avenue for data-subject rights and complaints in Kenya.
• Watch for official communication from the Treasury or ODPC, and weight that above any aggregator or leak-site chatter.

Attribution notes

Confidence levels, per house rules:

• A Bashe leak-site listing for ifmis.go.ke exists, posted ~13 April 2026 — high (mirrored consistently across trackers).
• Bashe actually exfiltrated IFMIS data — low (no dataset observed, no corroboration, and a group with a documented pattern of unverified/recycled claims).
• Specific data was exposed / specific individuals affected — unestablished (no evidence; not asserting it).
• Kenyan authorities confirmed or denied the incident — no verified public statement found at time of writing.

If any of these move — a dataset appears, an authority speaks — the post moves with them. That’s the deal.

Sources (defanged)

Reporting and official references only; no leak-site or stolen-data links.

• hxxps://www[.]odpc[.]go[.]ke/ (Office of the Data Protection Commissioner — Kenya)
• hxxps://www[.]treasury[.]go[.]ke/ (The National Treasury — Kenya)
• hxxps://www[.]ke-cirt[.]go[.]ke/ (National KE-CIRT/CC)
• hxxps://www[.]standardmedia[.]co[.]ke/ (Kenyan press coverage of state cyber incidents)
• hxxps://cloudsek[.]com/ (Bashe/APT73 credibility assessment, Jan 2025)
• hxxps://databreaches[.]net/ (Bashe claim-verification reporting, 2026)
• hxxps://www[.]suspectfile[.]com/ (Bashe claim-verification reporting, 2026)
• hxxps://www[.]ransomware[.]live/group/bashe (leak-site activity tracker)