Cyber Incident Victim: Central Bank of Kenya
Date:
May 2016
Location:
Kenya
Summary
The Central Bank of Kenya experienced a temporary disruption to its online services following a distributed denial-of-service (DDoS) attack by the Anonymous hacktivist collective and affiliated group Ghost Squad. This incident occurred as part of Operation Icarus, a coordinated campaign targeting numerous international financial institutions to protest corruption, particularly citing the Panama Papers revelations. The bank's website was rendered inaccessible alongside several other central banks globally during the operation, though services were restored shortly afterward. Anonymous publicly claimed responsibility for the attacks, framing them as a broader effort to challenge perceived financial system injustices.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On May 6-7, 2016, the Central Bank of Kenya experienced a distributed denial-of-service (DDoS) attack as part of a coordinated campaign by the hacktivist collective Anonymous and their affiliate Ghost Squad Hackers. The attack targeted the bank’s public-facing website, rendering it temporarily inaccessible to users. This incident occurred within a broader wave of cyberattacks dubbed “Operation Icarus,” which Anonymous had announced on May 4 via a video warning the global banking sector of impending disruptions. The group cited opposition to financial corruption and institutional power as motivations, explicitly linking some targets—such as the National Bank of Panama—to the Panama Papers leaks that exposed offshore financial activities of political elites.
The Central Bank of Kenya’s website was among eight international banking entities confirmed to have been disrupted during the initial phase of Operation Icarus. While the Central Bank of the Dominican Republic, Dutch Central Bank, and others were hit on May 6, the Kenyan bank’s outage occurred on May 7. Anonymous claimed responsibility for these attacks, which overwhelmed the banks’ web servers with traffic, though no data breaches or internal system compromises were reported. By the time of media reporting, all affected banking websites, including Kenya’s, had been restored to normal operation. The incident highlighted broader vulnerabilities in the financial sector, which had recently faced high-profile cyber incidents like the Bangladesh Bank heist and the Qatar National Bank data leak. Anonymous published a list of 160 additional financial institutions—including major entities like the World Bank and IMF—as potential future targets, though no further disruptions to the Central Bank of Kenya were documented in the immediate aftermath.