{
  "generated": "2026-09-25",
  "count": 4,
  "entries": [
    {
      "id": "KBR-2026-002",
      "date_disclosed": "2026-08-01",
      "date_incident": null,
      "organisation": "Social Health Authority (SHA)",
      "sector": "health",
      "county_or_scope": "national",
      "incident_type": "data_leak",
      "records_affected": null,
      "data_types": [
        "health",
        "pii"
      ],
      "threat_actor": null,
      "attribution_confidence": "none",
      "attribution_basis": "alleged unauthorised disclosure of patient records on social media by a political figure defending SHA; single secondary source; no ODPC statement found",
      "leak_site_claim": false,
      "regulator_action": null,
      "sources": [
        "https://blog.rankiteo.com/goknat1787585984-government-of-kenya-social-health-authority-breach-august-2026/"
      ],
      "indicators": "",
      "status": "seed_unreviewed",
      "last_reviewed": "2026-09-25",
      "notes": "WITHHELD: exact disclosure date not established (August 2026 per source); needs primary reporting (Nation"
    },
    {
      "id": "KBR-2026-001",
      "date_disclosed": "2026-07-18",
      "date_incident": "2026-07-18",
      "organisation": "Office of the President (president.go.ke)",
      "sector": "government",
      "county_or_scope": "national",
      "incident_type": "defacement",
      "records_affected": null,
      "data_types": [
        "unknown"
      ],
      "threat_actor": null,
      "attribution_confidence": "none",
      "attribution_basis": "homepage replaced with a ransom demand of 5 BTC and a same-day deadline; no actor named; government said no core databases were accessed and no sensitive data compromised",
      "leak_site_claim": false,
      "regulator_action": null,
      "sources": [
        "https://itweb.africa/article/presidency-hack-raises-kenya-security-concerns/j5alrvQAr3dvpYQk",
        "https://itweb.africa/article/kenya-restores-presidential-website-after-cyber-attack/Gb3Bw7WadxLq2k6V",
        "https://www.kenyans.co.ke/news/125382-presidents-official-website-hacked-hackers-demand-ksh8-million-ransom",
        "https://techpoint.africa/insight/kenyas-presidents-website-hack/",
        "https://thecyberexpress.com/kenya-cyberattack-defaced-president-website/"
      ],
      "indicators": "",
      "status": "confirmed",
      "last_reviewed": "2026-09-25",
      "notes": "Site taken offline within hours and restored by 20 Jul 2026. ICT Cabinet Secretary confirmed containment and forensic analysis. Third major public-sector incident in three years per ITWeb. Exfiltration not evidenced."
    },
    {
      "id": "KBR-2025-001",
      "date_disclosed": "2025-11-24",
      "date_incident": null,
      "organisation": "Diamond Trust Bank Kenya (with DTB Uganda)",
      "sector": "finance",
      "county_or_scope": "national",
      "incident_type": "regulatory_finding",
      "records_affected": 1,
      "data_types": [
        "financial",
        "pii"
      ],
      "threat_actor": null,
      "attribution_confidence": "none",
      "attribution_basis": "not applicable: ODPC determination on a complaint that a customer received a third party's bank statements and was denied access to her own",
      "leak_site_claim": false,
      "regulator_action": "ODPC determination of 24 Nov 2025: compensation of KES 250000 each from DTB Kenya and DTB Uganda (KES 500000 total) and an enforcement notice to DTB Uganda",
      "sources": [
        "https://www.odpc.go.ke/2025-determinations/",
        "https://www.capitalfm.co.ke/business/2025/12/dtb-fined-sh500000-for-data-privacy-breach/",
        "https://hapakenya.com/2025/12/05/odpc-fines-dtb-kenya-dtb-uganda-ksh-500000-for-data-privacy-breach/",
        "https://datagovernance.africa/cross-border-enforcement-strengthens-as-odpc-rules-in-aaditi-rajput-v-dtb-kenya-and-dtb-uganda/"
      ],
      "indicators": "",
      "status": "confirmed",
      "last_reviewed": "2026-09-25",
      "notes": "Regulatory finding rather than an intrusion; included because the register tracks regulator action. ODPC found no lawful basis for the processing and inadequate technical and organisational measures. Cross-border element (Uganda subsidiary) noted by commentators."
    },
    {
      "id": "KBR-2024-001",
      "date_disclosed": "2024-01-08",
      "date_incident": "2023-12-30",
      "organisation": "Kenya Airways",
      "sector": "transport",
      "county_or_scope": "national",
      "incident_type": "ransomware",
      "records_affected": null,
      "data_types": [
        "pii",
        "credentials"
      ],
      "threat_actor": "RansomEXX",
      "attribution_confidence": "medium",
      "attribution_basis": "RansomEXX posted the airline on its leak site with a data tree and samples (over 2GB claimed); reported independently by Daily Nation and Cybernews; the airline made no public acknowledgement at the time",
      "leak_site_claim": true,
      "regulator_action": null,
      "sources": [
        "https://nation.africa/kenya/business/kq-suffers-passenger-data-breach-in-cyber-attack-4486012",
        "https://cybernews.com/news/kenya-airways-attack-allegedly-exposes-passenger-details/",
        "https://izoologic.com/industry/airline/ransomexx-ransomware-leaks-confidential-files-of-kenya-airways/",
        "https://www.breachsense.com/breaches/kenya-airways-data-breach/"
      ],
      "indicators": "",
      "status": "confirmed",
      "last_reviewed": "2026-09-25",
      "notes": "Leak-site listing dated 30 Dec 2023; press coverage from 8 Jan 2024. Claimed contents include passport copies and incident reports. Record count not established. Victim statement not found; add if located."
    }
  ]
}