The National Computer and Cybercrimes Coordination Committee (NC4) has outlined four key details that must be included when reporting cybercrimes.
These requirements, according to NC4, are meant to ensure that the cyber incidents are rpeorted wth suffecnet infomrtain that will help assess their impact and the risks to affected individuals.
The first requirement of the breach is information about the breach itself; this includes details that establish what happened and the nature of the cyber incident being reported.
Secondly, there needs to be an estimate of the number of people affected, which helps the organisation to establish the potential scale of the incident, especially where personal information or services used by the public may have been compromised.
Overview of Nairobi cityscape on a cold day.
Photo
Canva
Additionally, the third requirement was an assessment of the risk of harm to the affected individuals, where, depending on the circumstances, a breach could expose people to risks such as identity theft, financial fraud, or even the issue of their personal information being exposed.
The final requirement included that they should provide reasons why affected individuals may be denied access to information about the breach.
In a recent study, an Interpol 2025 report on cybercrime attacks in African countries revealed that Kenya is now one of East Africa's biggest targets for online criminals, with attackers exploiting mobile money platforms and weak telecom safeguards.
The Interpol African Cyberthreat Assessment Report 2026, obtained by Kenyans.co.ke on August 3, singled out Kenya as a hub for mobile money fraud and infrastructure-targeted ransomware, painting a grim reality of a country whose digital growth has outpaced its ability to protect itself.
According to the report, Kenya recorded more than 46,786 Distributed Denial-of-Service (DDoS) attacks in just the first half of 2025, all aimed squarely at telecom companies that millions of Kenyans rely on daily.
As part of NC4 efforts to deal with cybersecurity in the country, the organisation is urging Kenyan to follow these steps to ensure successful reporting of cybercrimes, which can lead to loss of vital data of the organisation, as well as loss of money.
Kenya recorded more than 11.1 billion cyber threats in the financial year ending June 2026, with attacks designed to overwhelm online systems, known as Distributed Denial-of-Service (DDoS) attacks, more than doubling during the period.
Data from the Communications Authority of Kenya (CA) shows that the country recorded 11,124,632,684 cyber threats in the 2025/2026 financial year, a 29 per cent increase from 8,622,876,858 threats recorded in the previous financial year.
Further, under the law, operators of public and private computer systems or networks are required to report any cybercrimes to the NC4 within 24 hours of becoming aware of the threat, and failure to comply with the reporting requirements may attract fines of up to Ksh 200,00, imprisonment of up to two years, or both.
An aerial view of Nairobi City
Photo
Nairobi City Marathon