Who’s Hacking Ugandan Websites, and How

I went looking for a simple number: how many Ugandan websites get hacked each year?

It doesn’t exist, as far as I can find. The Police count cybercrime as one line. UCC reports on telecom networks. I found no public national count of hacked websites, so I’m not going to give you one.

What I can give you is a picture built from the evidence we do have. It’s less dramatic than the films, and much more useful. Most of the time, nobody is hacking you in particular.

What the official numbers say

The Uganda Police recorded 412 cybercrime cases in 2025, down from 474 in 2024. Of those 412, 101 went to court, 26 ended in conviction, and 247 were still under inquiry.

The report’s appendix puts the value lost at about Shs 5.3 billion, with about Shs 232 million recovered. That’s around 4 shillings back for every 100 lost.

Those are only the cases people reported, and they cover all computer crime, not just websites. At a public discussion this year, ACP Andrew Mubiru, the Police Director of Forensic Science, said banks and other institutions often disclose incidents only after severe damage is done. I’d expect a small business with a defaced website to be even less likely to walk into a police station. The true number is probably much higher, but nobody can say by how much.

So who is doing it?

Mostly automated tools, looking for money

Picture a program knocking on every door in the street, checking which ones are unlocked. That’s how most website attacks work. It doesn’t care that you’re a small hardware shop in Mukono. It cares that your plugin is out of date.

Patchstack, which tracks WordPress security, says heavily exploited flaws are first attacked a median of five hours after they become public. No person is reading your website in that time. It’s machines at scale.

Verizon’s 2026 breach report, which covers 145 countries, looked at more than 7,000 incidents at small and medium businesses. In its figures for confirmed breaches, outside attackers and a money motive both came to 100%. That’s global data rather than Ugandan, but I see no reason a thief in a hurry would treat Uganda differently.

People using stolen passwords

Eng. Christine Mugimba of UCC said this year that 713,235 Uganda-linked credentials had been found compromised in the past 12 months, from leaked email records and password-stealing malware. If your staff reuse the password from some old account on your website, someone may not need to hack anything. They can just log in.

Insiders

This one is uncomfortable. ACP Mubiru said “the insider threat is real”, and called it a bigger concern than AI-driven attacks. For a business, an insider could be a staff member who left on bad terms, or a developer who still has your login from three years ago.

Uganda’s best-known case points the same way. Finance ministry officials have been charged in court over the money reportedly taken from the Bank of Uganda in 2024. Those are allegations, and the accused are presumed innocent.

Protest groups, now and then

Uganda’s government sites were defaced by Anonymous-linked hackers over a decade ago in protests about LGBT rights. UCC also records that Anonymous Sudan claimed a DDoS attack on Ugandan telecom networks in February 2024. These attacks get headlines, but they’re aimed at governments and big names. A local business is unlikely to be the target.

How do they get in?

Verizon found that exploiting software flaws is now the most common way in, at 31% of breaches, ahead of stolen credentials at 13%. For small and medium businesses it was 26% and 13%, and phishing was 9%.

Three weak points matter most for a typical Ugandan site.

• Plugins. Patchstack counted 11,334 new WordPress flaws in 2025, and 91% were in plugins. Only 6 were in WordPress itself. For 46% of them, no fix was available when the flaw was made public.
• Old server software. UCC’s latest security report says Apache web servers used by Ugandan organisations still carry “known, albeit older” flaws, and it calls for timely patching.
• Passwords. Shared logins, reused passwords and old accounts nobody removed.

What we saw on 47 Ugandan homepages

We went back to the 48 sites from our phone test and read only what each homepage shows publicly. We didn’t probe or log in to anything. One site blocked us, which left 47.

• 30 of the 47 run WordPress. 25 of those show their version, and 22 of the 25 are on WordPress 7. That’s better than I expected. Core WordPress is largely being kept up.
• Only 6 of the 47 show their PHP version, which is the sensible thing to hide. But 3 of those 6 show versions that no longer get security fixes from the PHP project.
• 16 of the 47 send the header that tells browsers to always use a secure connection, and 11 send a content security policy, which limits what scripts can do.

This doesn’t mean any of these sites has been hacked or will be. Some hosts also patch older PHP themselves, and we can’t see that from outside. It’s a rough look at housekeeping, not a security audit. The finding I’d take from it is about plugins: the part that’s kept up isn’t the part most flaws are found in.

This month’s example

On 21 October 2026, the US cyber agency CISA urged organisations to patch two critical PHP flaws, nicknamed php2shell. They let someone with no password run code on a web server, and CISA has since listed them as being used in real attacks. PHP runs a huge share of the web, including every WordPress site.

According to the Daily Monitor, Kenya told government agencies to audit their systems and take portals offline if they couldn’t patch. In Uganda, CERT.UG published a notice telling administrators to apply patches, while the paper reported that it got no comment from NITA-U, UCC or the ICT ministry.

As Wasswa Godfrey, a security practitioner, told the paper: “Your hosting company has to run the patch.” You can’t fix this one from your WordPress dashboard. When I read about it, I checked our own server. It’s on 8.2.35, a patched version. That branch stops getting security fixes at the end of December, so we need to move up.

Most business owners have never had that conversation with their host. Now is a good time.

What to do this week

1. Ask your host in writing: “Which PHP version is my site on, and is it patched against php2shell?” You want one of 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. If you’re on 8.1 or older, CISA’s advice is to update it or take it offline.
2. Delete plugins and themes you don’t use. Update the rest.
3. List everyone with a login. Remove old staff and old developers today.
4. Give each person their own password, and turn on two-step login.
5. Keep a backup somewhere other than your hosting account, and test that it restores.
6. If you do get hacked, keep the evidence, change your passwords and report it to CERT.UG. Report it to Police too if money or customer data is involved.

How we did this

We read the Uganda Police Annual Crime Report 2025, UCC’s sector security reports, Verizon’s 2026 report summary and Patchstack’s 2026 findings. Quotes from officials come from PC Tech Magazine’s report of a public discussion. We checked 48 homepages on 31 October 2026, using ordinary page requests only, and we report totals without naming any site. The sample is hand-picked and mostly larger organisations.

One note on the Police figures: the report’s text gives 474 cases for 2024, while a chart in the same report shows 495. We used the text. The Shs 5.3 billion figure comes from the report’s appendix table.

Sources

• Uganda Police Force: Annual Crime Report 2025
• UCC: Communications Sector Cyber Security Posture Report FY 2024/25
• UCC: Communications Sector Cyber Security Posture Report FY 2023/24
• PC Tech Magazine: UCC, NITA-U, Police highlight Uganda’s cybersecurity threats, August 2026
• Verizon: 2026 Data Breach Investigations Report, executive summary
• Patchstack: State of WordPress Security in 2026
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• Daily Monitor: Uganda silent as Kenya, global tech giants patch critical software bug, 22 October 2026
• PHP: supported versions
• Business Times Uganda: Shs60 billion Bank of Uganda fraud case set for October trial
• NBC News: Activists hack Uganda government website over gay rights, 2012