NSSF Dismisses Claims That Hackers Had Taken Control Of Data Worth 2.5TB

The National Social Security Fund (NSSF) has refuted reports that its systems were breached and its database compromised, affirming that member data and financial records remain intact and secure.

In a statement issued on Tuesday, May 20, the Fund clarified that while there had been an attempted intrusion targeting one of its auxiliary systems—specifically its image storage system—its core infrastructure, which houses sensitive member information and handles all financial transactions, was not affected.

“NSSF wishes to inform members, stakeholders, and the public that there was an attempted breach targeting our image storage system. However, we assure Kenyans that the core system, which contains vital member data and financial records, remains uncompromised,” the statement read.

The Fund emphasized that this reassurance was grounded in preliminary findings from an ongoing forensic investigation, which had so far uncovered no evidence that personal or financial data had been accessed or extracted.

The statement comes amid rising concerns following online claims that a hacker group known as Devman had infiltrated NSSF’s systems. The cybersecurity analysis firm HackManac, through its X (formerly Twitter) account, alleged that Devman had seized control of the NSSF systems and exfiltrated 2.5 terabytes of data.

According to HackManac, the hackers are said to have issued a $4.5 million (approximately KSh579 million) ransom demand to the Kenyan government, accompanied by a 24-hour ultimatum threatening to release the data publicly if their demands are not met.

Despite the alarming nature of these claims, NSSF maintains that its critical systems are well-protected and that it is working with relevant authorities to ensure the attempted intrusion is fully investigated and mitigated.

The Fund has pledged to provide further updates as the investigation progresses.

Related Content: NSSF Is Working Towards Processing Benefits Within 24 Hours