A recent financial report from Kenya’s National Social Security Fund has shed light on a series of cyberattacks that have left many retirees in a difficult position. The breach, which compromised critical infrastructure, resulted in the delay of approximately $17 million in benefit payments, a significant blow to the agency’s 2.9 million members who rely on these funds for their livelihood.
While the agency had initially downplayed reports of a security failure back in 2025—despite claims from a hacker known as “Devman”—this latest audit serves as a candid admission of the disruption. According to data analyzed by Reports, the fund was slated to distribute $84 million in benefits for the financial year. However, due to the system outages and the resulting operational chaos, only $67 million actually reached beneficiaries, marking a sharp decline in year-on-year payouts.
The fallout has exposed glaring vulnerabilities in the fund’s digital strategy. Most notably, a million-dollar Data Recovery Centre, designed specifically to act as a safety net during such disasters, was still under construction when the attacks hit in May 2025. Furthermore, a planned $1.3 million upgrade to the member self-service portal had been delayed, leaving the fund reliant on outdated technology that proved unable to withstand the sophisticated nature of the intrusion.
This incident is part of a worrying trend across the continent. Cybersecurity experts have noted that as African public institutions race to digitize their services, they are often outpaced by the speed and evolution of cyber threats. We have seen similar breaches targeting major government bodies in South Africa, as well as financial institutions in Nigeria and various telecommunications firms.
The situation at the NSSF serves as a stark reminder that digital transformation must be backed by ironclad security. For millions of citizens whose pensions, taxes, and benefits are being moved online, the stakes couldn’t be higher. Without functional disaster recovery plans and timely technology refreshes, the very systems meant to provide security for workers may continue to leave them vulnerable.
