NSSF Dismisses Hacking Claims, Massive Data Breach and $4.5 Million Ransom Demand

A storm of concern swept Kenya following reports that hackers had infiltrated the National Social Security Fund (NSSF), gaining access to 2.5 terabytes of sensitive data. Kenyans feared their financial records and private details were exposed after a notorious group, Devman, claimed responsibility. The hackers even issued a $4.5 million ransom demand, claiming they had contacted the government. But just as panic grew, NSSF swiftly moved to clear the air. According to the Fund, their core systems are secure, and no critical data was compromised. Experts urge stronger cybersecurity after an alleged NSSF hacking attempt exposes vulnerabilities in Kenya’s digital infrastructure. [Photo/Screenshot] NSSF Hacking Claims Dismissed as Investigations Continue The NSSF has firmly denied claims that its database was breached following allegations by the Devman hacking group. In a public statement issued on Tuesday, May 20, the Fund reassured members and the general public that their core system—which stores members' financial transactions and personal data—remains intact and secure. “NSSF wishes to inform its members, stakeholders, and the general public of an attempted intrusion targeting its image storage system,” the statement read. “We wish to assure our members that the core system, which stores member data and financial transactions, remains secure and safe.” The response came after HackManac, a cyber attacks analysis firm, alleged on its X (formerly Twitter) account that Devman had breached the NSSF systems and stolen 2.5 terabytes of data. According to the firm, the group issued an ultimatum demanding Ksh579 million ($4.5 million), threatening to leak the information if their demands were not met within 24 hours. NSSF , however, dismissed these claims, stating that early investigations found no evidence of data being accessed or stolen. The Fund emphasized that its systems are under constant monitoring and that additional safeguards have been deployed. Public Concern Grows Over NSSF Hacking Allegations Despite NSSF’s reassurance, the hacking claims triggered an immediate wave of anxiety among Kenyans. Many feared that if the hackers’ claims were true, their private data—including ID numbers, bank details, and employment records—could fall into the wrong hands. Social media platforms were abuzz with debates and criticism, with many users demanding full transparency from the Fund. Some even called for an independent audit to verify NSSF’s statement. Others questioned how a vital institution such as NSSF could become a target, especially considering the rise in cyberattacks targeting state agencies across Africa. In recent weeks, similar breaches have been reported in Morocco and Egypt, raising fears of a regional cybercrime surge. Government Urged to Bolster Cybersecurity Infrastructure The alleged NSSF hacking incident has renewed calls for the Kenyan government to strengthen its cybersecurity systems. Experts argue that while NSSF appears to have contained the situation, the mere attempt by hackers to access such a large volume of data is alarming. Cybersecurity specialists have warned that public institutions are becoming increasingly vulnerable due to outdated systems, limited cyber defense capacity, and a lack of awareness. The government is now being urged to invest in advanced monitoring tools, conduct regular penetration tests, and implement strict data access policies across all state agencies. “Kenya must treat cyber threats with the same seriousness as physical threats,” said one IT security analyst. “Today, data is currency. Losing it to criminals could lead to identity theft, financial fraud, or even national security risks.” NSSF Stands Firm Amidst Global Trend of Social Security Hacks The NSSF incident mirrors a growing global trend of hacking groups targeting national social security institutions. Hackers appear to be focusing on entities that hold mass amounts of citizen data and financial records, seeing them as high-value targets. In North Africa, Morocco’s National Social Security Agency and Egypt’s National Social Insurance Authority were recently reported to have suffered similar cyber intrusions. In both cases, authorities also denied any major data loss, although investigations are still ongoing. For Kenya, this wave of attacks acts as a wake-up call. Even though NSSF denies any data loss, the incident underlines the importance of constant vigilance and rapid response mechanisms. In the meantime, NSSF has pledged to keep the public informed as the investigation continues. The Fund insists it will remain transparent and accountable to its members. While the hacking claims remain unverified, one thing is clear: Kenyans now expect more proactive cybersecurity measures from their government and public institutions to ensure their data stays safe in an increasingly digital world.