Back Kenyans.Co.Ke

Experts Explain What Happens After Your Critical Data Has Been Breached

Kenyans.Co.Ke • October 14, 2026

The National Computer and Cybercrimes Coordination Committee (NC4) has outlined four key details that must be included when reporting cybercrimes.

These requirements, according to NC4, are meant to ensure that the cyber incidents are rpeorted wth suffecnet infomrtain that will help assess their impact and the risks to affected individuals.

The first requirement of the breach is information the breach itself; this includes details that establish what happened and the nature of the cyber incident being reported.

Secondly, there needs to be an estimate of the number of people affected, which helps the organisation to establish the potential scale of the incident, especially where personal information or services used by the public may have been compromised.

Additionally, the third requirement was an assessment of the risk of harm to the affected individuals, where, depending on the circumstances, a breach could expose people to risks such as identity theft, financial fraud, or even the issue of their personal information being exposed .

The final requirement included that they should provide reasons why affected individuals may be denied access to information the breach.

In a recent study, an Interpol 2025 report on cybercrime attacks in African countries revealed that Kenya is now one of East Africa's biggest targets for online criminals, with attackers exploiting mobile money platforms and weak telecom safeguards.

The Interpol African Cyberthreat Assessment Report 2026 , obtained by Kenyans.co.ke on August 3, singled out Kenya as a hub for mobile money fraud and infrastructure-targeted ransomware, painting a grim reality of a country whose digital growth has outpaced its ability to protect itself.

According to the report, Kenya recorded more than 46,786 Distributed Denial-of-Service (DDoS) attacks in just the first half of 2025, all aimed squarely at telecom companies that millions of Kenyans rely on daily.

As part of NC4 efforts to deal with cybersecurity in the country, the organisation is urging Kenyan to follow these steps to ensure successful reporting of cybercrimes, which can lead to loss of vital data of the organisation, as well as loss of money.

Kenya recorded more than 11.1 billion cyber threats in the financial year ending June 2026, with attacks designed to overwhelm online systems, known as Distributed Denial-of-Service (DDoS) attacks, more than doubling during the period.

Data from the Communications Authority of Kenya (CA) shows that the country recorded 11,124,632,684 cyber threats in the 2025/2026 financial year, a 29 per cent increase from 8,622,876,858 threats recorded in the financial year.

Further, under the law, operators of public and private computer systems or networks are required to report any cybercrimes to the NC4 within 24 hours of becoming aware of the threat, and failure to comply with the reporting requirements may attract fines of up to Ksh 200,00, imprisonment of up to two years, or both.

Huduma Kenya Explains New Ksh150 Fee After Uproar

EPRA Increases Petrol, Diesel and Kerosene Prices for October-November Cycle

Ministry of Health Confirms Second Ebola Case in Kenya

High Court Rules on Order Blocking Construction of Dangote Lamu Oil Refinery

Kenyan Drivers Among Six Reportedly Captured by Rebels in DRC

Governors Demand Ksh100 Billion More as Row Erupts Over County Funding

IEBC Summons Senior UDA Official

Opiyo Wandayi Addresses Gachagua's Explosive Claims on Fuel Prices

Employers Risk Ksh1 Million Fine as Parliament Passes New Bill on Nursing Mothers

IEBC Announces Requirement for Political Parties Ahead of 2027 Polls, Sets Deadline

Kenyan MP Wins International Award

WHO Explains Why Kenya Should Keep Borders Open Despite Ebola Fears

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cybersecurity Incident Reporting in Uganda: New Regulatory Focus In 2026, Uganda has prioritized cybersecurity incident reporting for telecoms, ISPs, and digital platforms. The Uganda Communications Commission (UCC) and the National Information Technology Authority (NITA-U) have set clear obligations for reporting cyber incidents, particularly for licensed telecom operators and ISPs. Entities designated as Critical Information Infrastructure (CII) face enhanced reporting duties. The National Computer and Cybercrimes Coordination Committee (NC4) in Kenya has also outlined specific requirements for reporting breaches, emphasizing the need for detailed information about the incident and its impact. Reports indicate that Kenya has become a significant target for cybercriminals, with over 11 billion cyber threats recorded in the last financial year. The regulatory landscape is evolving to ensure timely reporting and response to cyber incidents, reflecting a growing recognition of the importance of cybersecurity in the region. 2 sources 44

Extracted Entities

Experts Explain What Happens After Your Critical Data Has Been Breached

The full story

Extracted Entities

Attack Types (2)

Countries (1)

Domains (1)