Strike Exposes Hackers in Multimillion-Shilling Kilifi Payroll Heist

An ongoing industrial strike in Kilifi County has exposed a major cyber-vulnerability, revealing a multimillion-shilling payroll heist executed by hackers.

The groundwork for the massive fraud was quietly laid through a series of unauthorised system entries over an extended period.

Investigators discovered that the hackers gained entry into the county financial networks, altering critical staff records and payment credentials.

The breach remained hidden until workers downed their tools, which disrupted regular administrative routines, when an internal audit was triggered.

Discrepancies quickly came to light as finance officers cross-checked payroll data against actual attendance records during the labor dispute.

Unauthorised configuration changes in the system allowed illicit funds to flow into external bank accounts before detection occurred.

The incident has raised serious questions about the security of the Integrated Financial Management Information System (IFMIS) in devolved units.

This automated platform handles multi-billion-shilling disbursements from the national government, making it a primary target for sophisticated syndicates.

Officials from the Kilifi County Government confirmed that cyber-security experts are now conducting a thorough forensic investigation into the matter.

Local authorities are working alongside detectives from the Directorate of Criminal Investigations (DCI) to trace the stolen public funds.

Preliminary reports indicate that the hackers exploited weak access controls, which compromised user credentials to bypass internal security protocols.

The county administration has vowed to prosecute any internal staff, who may have colluded with external actors to facilitate the theft.

Meanwhile, residents continue to express deep frustration over the recurring mismanagement of public resources and the disruption of essential services.

The ongoing strike, which originally began over labor grievances, has now evolved into a broader conversation about transparency and institutional integrity.

Representatives from the Kenya National Union of Nurses and Midwives (KNUNM) noted that administrative failures directly impact worker welfare and public trust.

Union officials argue that funds are lost to cyber-criminals, but essential workers face severe delays in salary payments and promotions.

The Ethics and Anti-Corruption Commission (EACC) has also been invited to examine historical procurement and payroll discrepancies within the region.

Financial experts suggest that county governments must invest heavily in modern cyber-infrastructure to safeguard taxpayer money against such digital threats.

Regular system audits and strict multi-factor authentication are critical to preventing further unauthorised entries into sensitive government databases.

As investigations intensify, the local community remains anxious for full accountability and a swift resolution to the current crisis.

Security analysts warn that devolved entities often lack the specialized personnel required to counter sophisticated international hacking networks.

The vulnerability in Kilifi highlights a systemic weakness across multiple counties where IT systems remain inadequately monitored and updated.

Members of the County Assembly (MCAs) have demanded a comprehensive brief from the executive regarding the total financial loss incurred.

Lawmakers argue that public funds meant for infrastructure development should not be diverted or lost through technological gaps and negligence.

The legal framework requires every county to maintain an independent audit committee, but enforcement across the country remains highly uneven.

Governor Gideon Mung'aro has reportedly ordered a complete overhaul of the digital access rights assigned to all county personnel.

This measure is intended to ensure that no single individual can authorize substantial financial transfers without secondary executive clearance.

The outcome of this forensic audit will likely influence cyber-security policies across the remaining forty-six devolved governments in Kenya.

For now, the focus remains on secure recovery of systems and ensuring that legitmate workers do not suffer further payroll disruptions.