Three stories that matter to organisations in Kenya and East Africa this week, what each means in practice, and what to do about it. Two are from the past week; the third puts the regulator's own enforcement figures in context. All sources are public and linked at the end.
- A VPN flaw that gets ransomware crews past MFA
- What the ODPC's own figures say about enforcement
- The 72-hour test: what customers do when their data is breached
Network · Remote access
A VPN flaw that gets ransomware crews past MFA
Palo Alto Networks' Unit 42 updated its threat brief on CVE-2026-0257 on 19 and 20 October. The flaw is an authentication bypass in the GlobalProtect portal and gateway components of PAN-OS, and it lets an unauthorised party start VPN sessions. It has been on CISA's Known Exploited Vulnerabilities list since May, so it is not new. What has changed is who is using it, and what they do once inside.
Unit 42 says ransomware operators it tracks as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are exploiting it. In the cases it describes, attackers open a VPN session that bypasses MFA, scout the network with remote-management tools, then move sideways over RDP and SMB. In one investigation they reached a vCenter appliance, disabled security controls on ESXi hosts, and copied credentials offline from a domain controller's virtual disk. Some attackers also chained the flaw with an older Veeam vulnerability, CVE-2023-27532.
Why it matters here: The lesson is wider than one vendor. Any organisation with branches, depots or remote staff depends on a remote-access gateway, and a bypassed gateway makes MFA on the VPN irrelevant. In the cases Unit 42 describes, the damage came after entry: networks that let a VPN user reach virtualisation management, domain controllers and backup systems.
Check the source, not this summary. Affected versions, the fix and workarounds are in Palo Alto Networks' own security advisory. Use that to decide what to patch.
What to do this week
- Confirm your exposureFind out whether you run GlobalProtect, which version, and whether the vendor's fix or workaround is in place.
- Test from outsideUnit 42 recommends checking from an external browser whether management interfaces are reachable, and restricting access with Interface Management profiles.
- Search your logsLook through GlobalProtect logs for the indicators Unit 42 lists. Treat any matching successful session as an incident, not a curiosity.
- Cut the path after the gatewayThe VPN address pool should not have a route to hypervisor management, backup servers or domain controllers unless a rule says so on purpose.
- Patch what attackers chainBackup software and virtualisation management appear in these attacks. Give them the same urgency as the gateway.
A remote-access gateway flaw is being used to start ransomware attacks.
The Network and Systems layers of S.I.N.S.: what the gateway exposes, how far a VPN user can travel, and how well hypervisors and backups are isolated.
A Health Scan finds the gaps, scores them and documents them, so the fix list is ordered by risk. Managed Security Services adds monitoring and incident response on a retainer.
GRC · Kenya · Background
What the ODPC's own figures say about enforcement
Enforcement under the Data Protection Act keeps coming up in Kenyan commentary, and the figures usually quoted come from the regulator itself. In November 2024, marking five years since the Act took effect, the Office of the Data Protection Commissioner reported 7,223 registered data handlers, 138 impact assessments reviewed, 192 advisories, 58 audits and inspections, 68 enforcement notices and 11 penalty notices. These are the ODPC's cumulative figures to that date. We could not find a newer official tally, so treat them as a snapshot, not a current scorecard.
Read plainly, there are several enforcement notices and audits for every penalty: 68 and 58 against 11. Under section 63 of the Data Protection Act, 2019, a penalty is capped at KES 5 million or 1% of the previous year's turnover, whichever is lower.
RETACH's reading: audits and enforcement notices are, in practice, requests to show evidence. An organisation with a data map, a documented lawful basis for each activity, signed processor agreements, a tested breach procedure and training records is in a better position long before any fine is discussed.
What to do this week
- Start an evidence fileCollect the data map, lawful-basis record, privacy notice, processor contracts, incident procedure and training records in one place.
- Check processor contractsEvery vendor that handles personal data for you should be under a written data processing agreement.
- Confirm your registration positionWhether you must register with the ODPC depends on size, sector and the type of data you process. Confirm where you stand rather than assuming.
- Name an ownerSomeone senior should own data protection compliance and report on it to leadership.
For a fuller checklist, see our guide to Kenya's Data Protection Act.
General information, not legal advice. For decisions about your own obligations, consult a qualified advocate.
The regulator audits, issues enforcement notices and imposes penalties, and notices far outnumber fines.
Whether you can show, on paper, that you handle personal data lawfully and could answer a notice or an audit.
Governance, Risk & Compliance work maps your current data processing against the Data Protection Act and produces a prioritised remediation plan. A Virtual CISO can own the programme if you have no one in-house.
Incident readiness · Kenya
The 72-hour test: what customers do when their data is breached
TransUnion's Consumer Pulse Study, reported by The Star on 21 October, asked Kenyans who had been told their account details were stolen what they did next. The reactions were fast and personal: 57% changed the password on the affected account, 54% changed passwords elsewhere, and 46% checked for unauthorised activity. About a quarter (25%) contacted the business that was breached, and 14% filed a police report. The report does not state the sample size or method, so treat the figures as indicative.
For the business, the number that matters is not on that list. Under the Data Protection Act, 2019, a breach likely to put people at risk must be reported to the ODPC within 72 hours of becoming aware of it. In practice, customers can react before an organisation has agreed who is allowed to speak.
Run a 72-hour drill
- Decide who decidesName the person who judges whether an incident is a reportable breach, and a deputy.
- Pre-write the messagesKeep a draft ODPC notification and a draft customer message ready to edit, not to create.
- Know where the logs areRecord where logs live and who can retrieve them out of hours.
- Brief customer supportIn the survey, about a quarter of notified customers contacted the business. Agree what support will say.
- Include your vendorsTell key suppliers how to report a suspected incident to you, and how fast.
Breach victims act within hours. The legal clock is 72 hours.
Decision rights, contacts, log locations and message drafts that exist only in people's heads.
Managed Security Services covers monitoring and incident response. Governance, Risk & Compliance can write and test the breach procedure. A Virtual CISO can run the drill with your leadership.
How RETACH works on this
RETACH works in a loop: Assess, Quantify, Remediate, then repeat. We call it the AQR Cycle. A Risk Delta is the change in an organisation's measured risk position before and after a S.I.N.S. Intervention™. It is how a board can see that the fixes above made a difference, rather than taking it on trust.
See where your organisation stands
Start with a free S.I.N.S. Score, or ask for a quote for a Health Scan.
Sources
- Palo Alto Networks Unit 42, Active Exploitation of PAN-OS CVE-2026-0257 (updated 20 October 2026).
- Office of the Data Protection Commissioner, Kenya Marks 5 Years since the Implementation of the Data Protection Act (20 November 2024).
- The Data Protection Act, No. 24 of 2019 (sections 43 and 63).
- The Star, Most frequent actions data breach victims took (21 October 2026), reporting TransUnion's Consumer Pulse Study.
RETACH summarises these sources in its own words. Figures belong to the publishers and have not been independently verified by RETACH.