eCitizen Anonymous Sudan DDoS attack

Beginning on 23 July 2023, the pro-Russian hacktivist group Anonymous Sudan launched a sustained distributed denial-of-service (DDoS) campaign against eCitizen, the unified portal through which the Kenyan government had just consolidated roughly 5,000 public services. Within days, ordinary Kenyans found they could not pay for electricity, move money, or apply for travel documents.

What happened

Weeks earlier, Kenya had routed thousands of government services — and their payments — through a single eCitizen gateway. That consolidation made the portal enormously convenient and a single point of failure. Anonymous Sudan exploited exactly that, flooding the platform with what ICT Cabinet Secretary Eliud Owalo described as "extraordinary requests" designed to overwhelm and clog the system.

The attack rippled far beyond eCitizen. Affected services reportedly included:

• M-Pesa, the mobile-money backbone operated by Safaricom, with bank-to-wallet transfers and USSD transactions failing intermittently.
• Kenya Power electricity-token purchases, leaving households unable to top up prepaid meters.
• Visa and immigration processing, prompting emergency visa-on-arrival measures.
• Rail ticketing, business registration, university and hospital websites, and major media outlets.

Government response

Kenyan technical teams blocked the offending source IP addresses, though intermittent disruption persisted for several days. Owalo publicly confirmed that no data was accessed or stolen — consistent with a DDoS, which floods availability rather than breaching confidentiality. The government framed the incident as a resilience failure to be hardened rather than a data breach.

Attribution and motive

Anonymous Sudan claimed the campaign was retaliation for Kenyan statements it said cast doubt on the sovereignty of Sudan's government, amid Nairobi's mediation role in the Sudanese civil war. Security researchers widely assess that, despite its name and stated cause, the group operates as a pro-Russian outfit with ties to broader Kremlin-aligned hacktivist networks, specialising in disruptive, low-sophistication DDoS attacks against Western allies and their partners.

Why it matters

The eCitizen attack is a cautionary tale about digital-government centralisation. Funnelling 5,000 services and their payment rails through one portal delivered efficiency but created a target whose disruption cascaded across finance, energy, transport and immigration simultaneously. It pushed Kenya — and other rapidly-digitising African states — to invest in DDoS mitigation, traffic scrubbing and redundancy for critical-information infrastructure, and it showcased how a relatively unsophisticated hacktivist group can paralyse a nation's daily life by attacking availability alone.