The U.S. Embassy in Nairobi published a security alert on September 25, 2026 warning that a possible breach may have hit traveler data collected during Ebola screening at Kenyan ports of entry. The Embassy says the exposed set may include biographic information such as names, passport numbers, and health information gathered while screening people for possible Ebola exposure. Kenya’s government is aware of the incident and has said it will release more detail as investigators finish their work.
This is not a ransomware leak-site rumor. It is an official U.S. diplomatic security alert describing a possible Kenya ports of entry data breach tied to public-health border screening. The Embassy is clear about what it cannot yet say: it cannot confirm whether any specific traveler’s record sits inside the breached cohort. That honesty matters. If you entered Kenya from one of the listed countries after heightened screening began at the end of May 2026, treat yourself as potentially in scope until Kenyan authorities publish a narrower census — which, as of indexing, still does not exist.
BreachHistory’s canonical record is at /kenya-ports-of-entry/kenya-ebola-screening2026. Primary sources are the U.S. Embassy Nairobi alert of September 25, 2026 and contemporaneous local coverage by Kenyans.co.ke.
What the U.S. Embassy Nairobi alert actually says
Strip away the rumor mill and the Embassy’s language is precise. Location: Kenya. Event: the Mission is following a possible breach of data collected at Kenyan ports of entry on travelers screened for possible Ebola exposure. Data types that “may include” biographic information: names, passport numbers, and health information. Actions: Kenya’s government knows about the data breach and will provide more information; readers seeking general breach hygiene can consult the U.S. Federal Trade Commission’s data-breach resources.
Two phrases do a lot of work. “Possible breach” means the diplomatic channel is not pretending the forensics are finished. “Data breach” in the same alert — “The government of Kenya is aware of the data breach” — is stronger than a vague “cyber incident.” Together they describe a live investigation into unauthorized access or loss of screening records, not a routine misdirected email.
What this is not: a published count of records affected, a named attacker, a described malware family, or a statement that every passport scanned at JKIA since May sits in a dark-web dump. Kenyans.co.ke correctly noted that the alert does not say how many people may be affected, when the possible breach occurred, or whether information was accessed, copied, or released. Those gaps are real. They do not erase the Embassy’s decision to warn travelers in public.
Timeline of the Kenya Ebola screening data incident
- Late May 2026: Heightened Ebola screening begins at Kenyan ports of entry for travelers arriving from a defined list of countries in East and Central Africa.
- Late May 2026 – September 25, 2026: Screening collects biographic and health information from travelers in that cohort. Public reporting has not published the exact start or end of any unauthorized access window inside that period.
- September 25, 2026: U.S. Embassy Nairobi issues a security alert titled around a possible data breach of Ebola-screening traveler data. The alert states Kenya’s government is aware and will share more as available.
- September 26, 2026: Kenyan press, including Kenyans.co.ke, amplifies the Embassy warning for domestic and regional readers.
- As of September 27, 2026 indexing: No official Kenyan headcount, no confirmed attack path, and no public statement that individual travelers can check a lookup portal for inclusion.
Four months of heightened screening is a long window for a border-health system to accumulate dense identity plus clinical triage notes. Even without a published census, anyone who flew, drove, or otherwise entered Kenya from the listed origins after late May should assume their screening packet could have been among the records the Embassy is discussing.
What data may have been exposed
The Embassy’s inventory is short and serious:
- Names
- Passport numbers
- Health information collected during Ebola-exposure screening
That mix is not a loyalty-card dump. A passport number plus a legal name is enough to fuel travel-document fraud, lookalike booking scams, and social-engineering scripts that already know which border you crossed. Health information collected during Ebola screening is a different category again: fever checks, exposure questionnaires, contact details for follow-up, isolation or referral notes, and other clinical-adjacent fields that public-health officers need at the gate. The Embassy did not publish a field-by-field schema. Treat “health information” as sensitive traveler health data until Kenya says otherwise.
Passport numbers are especially durable. Unlike a password, you cannot rotate a passport number overnight without a new document. Criminal markets price passport identifiers for account recovery abuse, fraudulent visa applications, and phishing that cites your exact document number so the bait looks official. Pair that with a health-screening context — “your Ebola follow-up results are ready” — and the social-engineering surface expands past ordinary travel spam.
Names matter because they glue the other fields to a person who can be called, emailed, or messaged on WhatsApp. Border-screening workflows often capture phone numbers and onward addresses even when an Embassy alert does not list every field. Do not invent those fields into the official inventory; do expect attackers who obtain a screening spreadsheet to already have enough to craft personalized messages.
What was not disclosed
As of the September 25 alert and September 26 local coverage:
- No official records-affected census (catalogued as unpublished / zero until Kenya or a regulator publishes a count)
- No confirmed date of intrusion, exfiltration, or discovery beyond the alert itself
- No statement whether data was merely accessed, copied, or publicly released
- No named threat actor, ransomware brand, or insider
- No confirmation that any specific individual’s row is inside the set
- No public list of which ports of entry (air, land, sea) fed the affected system
Those omissions are frustrating for travelers searching “was I affected by the Kenya Ebola screening breach.” They are also normal early in a government investigation. The right response is not to invent a million-record figure from airport throughput guesses. The right response is to act on the attested risk — passport and health-screening PII for a defined travel cohort — while waiting for Kenya’s promised updates.
Who is at risk
Travelers from the Embassy’s listed countries since late May 2026
The alert’s cohort language is concrete. Individuals may be impacted if they traveled to Kenya from Angola, Burundi, the Democratic Republic of the Congo, Ethiopia, Rwanda, Somalia, South Sudan, Tanzania, Uganda, or Zambia since heightened screening began at the end of May 2026. That list tracks regional Ebola-risk routing into Kenya’s hubs, not a random continent-wide scoop.
If your itinerary put you in that set — whether you are a Kenyan returning home, a U.S. citizen on official or tourist travel, a regional business traveler, an NGO worker, or a dual national — you are in the primary risk group the Embassy described. Citizenship of the traveler is not the filter; origin of the inbound journey is.
U.S. citizens and other foreign nationals who used Kenyan ports of entry
The Mission wrote to its audience because American travelers use Jomo Kenyatta International Airport and other Kenyan gates heavily. The same logic applies to EU, UK, Asian, and African passport holders who arrived from the listed countries during the heightened-screening window. Passport fraud and health-related phishing do not respect nationality.
People living or working in Kenya who assisted screened travelers
Household members, drivers, hotel staff, and colleagues sometimes appear in contact-tracing or onward-address fields collected at screening. The Embassy did not say household contacts were breached. Still, if someone in your household was screened and later receives a call that already knows their passport number and arrival date, brief the household before they “confirm” anything over the phone.
Why border Ebola-screening data is high-value
Public-health border controls create concentrated databases under time pressure. During an Ebola scare, ports of entry collect identity fast so contact tracers can find people later. That urgency is medically rational and cyber risky: temporary screening tools become durable stores of passport-grade identity plus symptoms and exposure answers.
Attackers who want travel documents, immigration fraud material, or blackmail leverage against people who answered sensitive exposure questions will price this dataset higher than a retail email list. Health stigma compounds the problem. Even a negative Ebola screen can become harassment material if an adversary can prove you were pulled aside at the airport and asked about contacts in a high-risk zone.
Kenyans.co.ke noted adjacent Communications Authority reporting of heavy cyber-threat volume in Kenya’s 2025/2026 financial year. That national context does not prove how this incident happened; it only frames why a ports-of-entry health database is a plausible target. Unlike a retail breach where the first ask is a credit freeze, the durable assets here are travel documents and spoofed “Ministry of Health / port health” phishing — though freezes still help if passport numbers feed financial fraud.
What officials have said — and what they have not
U.S. Embassy Nairobi: following a possible breach; may include names, passport numbers, health information; cannot confirm individual inclusion; Kenya aware; more information forthcoming; FTC breach resources for general guidance; Embassy contact channels listed for U.S. citizen services.
Government of Kenya: acknowledged awareness via the Embassy’s statement; had not, as of the alert and next-day local press, published a detailed post-mortem, victim count, or self-service lookup in the sources cited here.
Kenyans.co.ke: restated the Embassy facts for a Kenyan audience, underlined the absence of a headcount and attack narrative, and placed the story next to broader CA cyber-threat statistics without claiming those statistics explain this breach.
Readers should watch official Kenyan health, interior, ICT, or port-health channels for the next primary notice — not random Telegram forwards claiming “full JKIA Ebola dump for sale.” Unverified sale listings are a separate problem; this catalog row is grounded in the Embassy alert.
Industry and campaign context
Government identity and health systems keep appearing in 2026 breach coverage for the same structural reason: one database holds millions of high-assurance identifiers. The Defense Manpower Data Center file-share incident in the United States showed how military SSNs and occupational fields become targeting aids. A Kenyan ports-of-entry Ebola screen is a different geography and a different schema, but the pattern rhymes — concentrated biographic data collected for a legitimate mission, then put at risk when the collection system is breached.
Healthcare breaches the same month reinforce the point: health-adjacent datasets enable extortion and highly believable phishing, not only card fraud. Border screening sits where immigration identity meets public-health triage — passport numbers plus fever questionnaires. To be clear: public sources have not tied Kenya’s incident to a named ransomware crew or another country’s border-health breach. Context here is threat economics, not invented attribution.
What you should do
If you entered Kenya from Angola, Burundi, DRC, Ethiopia, Rwanda, Somalia, South Sudan, Tanzania, Uganda, or Zambia since late May 2026 — or you believe your screening data could have been captured in that program — work this list.
- Save the Embassy alert and watch Kenyan government notices. Screenshot or PDF the September 25 security alert. Check Ministry of Health, immigration, ICT Authority, and port-health channels for an official census or remediation notice before trusting third-party “breach check” sites.
- Treat your passport number as sensitive forever. You cannot reset it like a password. Store physical and digital copies carefully. If your passport is near expiry, plan renewal deliberately rather than panicking into a scam “expedited replacement” site that asks for the same number again.
- Enable travel-document and airline-account MFA. Lock down airline loyalty accounts, embassy appointment portals, and email inboxes that receive boarding passes. Passport-number phishing often aims at the mailbox that already holds your itineraries.
- Freeze or monitor credit where you hold financial lives. Especially for U.S. persons following FTC guidance linked from the Embassy alert. Passport data sometimes feeds synthetic-identity and account-recovery fraud even when the breach itself was health-screening focused.
- Assume health-screening phishing is coming. Messages that cite Ebola, “port health clearance,” “repeat temperature check,” or “Ministry follow-up for your May–September Kenya arrival” are high risk. Verify through official bookmarks, not links in SMS or WhatsApp.
- Do not re-submit passport scans to strangers “to confirm you are not in the breach.” Real governments notifying victims do not need you to upload a fresh biodata page to a newly registered domain.
- Brief family and colleagues who know your itinerary. Attackers who know you flew Nairobi–Addis or crossed a land border can call relatives claiming you are stuck in secondary screening and need a fee paid.
- U.S. citizens: use Embassy channels for consular questions, not random Facebook groups. The alert lists U.S. Embassy Nairobi contacts and State Department Consular Affairs numbers. Enroll in STEP for future security messages.
- Document suspicious contacts. Save numbers, emails, and payment demands that reference Ebola screening. Report fraud through local police cyber units and, for U.S. persons, identitytheft.gov workflows as appropriate.
- Plan for a long tail. Passport and health-context fraud can appear months after a September alert. Keep skepticism high through 2027 even if Kenya later says the technical incident is closed.
Phishing and fraud patterns to expect
Real diplomatic alerts create perfect cover for fake ones. Expect:
- Emails or WhatsApp notes claiming “U.S. Embassy / Ministry of Health — confirm passport to see if you are in the Ebola screening breach.”
- Lookalike domains mimicking port health, eCitizen, or embassy appointment systems.
- Calls that already know your arrival week and origin country and ask for the rest of the passport biodata “to finish your case.”
- Fake fee demands for “re-issuance of Ebola clearance certificates” required for your next flight.
- Malware-laced PDFs titled “Kenya_Ports_Breach_Notice.pdf” sent to NGO and corporate travel desks.
Real officials will not demand your full passport number over an unsolicited call to tell you whether you were breached. Hang up. Use the phone numbers and URLs on official .gov sites — ke.usembassy.gov for the U.S. Mission, and Kenyan government domains you already trust — not the link in a panic forward.
Was I affected?
Honest answer: the Embassy cannot tell you yet, and neither can a public catalog. If your travel matches the origin-country list and the late-May-2026-onward window, you are in the population the alert says may be impacted. If you never entered Kenya from those countries during heightened screening, this specific cohort language does not put you in scope — though you should still ignore phishing that name-drops the incident.
Have I Been Pwned will not magically list “Kenya Ebola screening 2026” the week of an Embassy alert about a government health database. Rely on Kenyan official notices and the Mission’s updates, not paste-site titles.
Searching “Kenya Ebola screening data breach” or “Kenya ports of entry passport breach 2026” should lead you back to primary documents, not to paid “removal” services. Nobody can scrub a passport number from an adversary’s copy by charging your card.
Canonical record and sources
Full BreachHistory catalog entry: 2026 Kenya ports of entry — possible Ebola-screening traveler PII/PHI breach.
Primary and contemporaneous sources:
- U.S. Embassy Nairobi — Security Alert: Possible Data Breach (September 25, 2026)
- Kenyans.co.ke — U.S. Embassy warns of possible data breach in Kenya Ebola screening travellers (September 26, 2026)
- U.S. Federal Trade Commission — Data breach resources (linked from the Embassy alert for general guidance)
The Kenya Ebola screening ports breach story is still early: possible unauthorized exposure of names, passport numbers, and health information collected at the border since late May 2026, confirmed as a live concern by U.S. Embassy Nairobi, with Kenya’s government aware and a public census still unpublished. If you traveled that corridor, treat your passport biodata and any screening follow-up as hostile territory for phishing until official notices say otherwise — and even after they do.