As Kenya’s betting industry faces unprecedented scrutiny over data privacy and regulatory compliance, major operators including Betika and Kwikbet have emerged at the center of an expanding investigation into illicit subscriber data acquisition, the report has also been highlighted by the STAR.
The Gambling Regulatory Authority (GRA) has officially confirmed that it is conducting a full investigation into the firms following allegations that the company purchased the stolen personal data of millions of Safaricom subscribers to artificially inflate its customer base.
This high-profile probe draws directly from a detailed Directorate of Criminal Investigations (DCI) forensic report as well as a landmark High Court judgment that has already cost Safaricom Sh9.9 million in damages.
The regulator’s confirmation follows a formal complaint lodged by businessman Benedict Kabugi Ndungu the original whistleblower who first reported the massive Safaricom data breach to the police in 2019 who explicitly named the firms including Betika, and Kwikbet as licensed gambling firms that allegedly received and commercially profited from subscriber information obtained through the breach.
The companies are alleged to have acquired stolen data covering roughly 29.9 million Kenyans across multiple separate transactions.
The forensic record is built substantially on WhatsApp communications exchanged between former Safaricom employees and their alleged buyers.
Kabugi’s complaint, officially addressed to DCI boss Mohamed Amin and GRA Director General Peter Maina Karimi, explicitly requests that the regulator suspend the firms’ operating licences pending the final outcome of its investigation, rather than allowing the renewal cycle to run its ordinary course.
The court found that Safaricom employees systematically extracted the personal data of 11.5 million subscribers over roughly seven years and trafficked it to third-party betting companies for commercial gain. Eleven petitioners were awarded Sh900,000 each in general damages, totaling Sh9.9 million, with additional costs and interest expected to push the final liability closer to the Sh11 million mark once fully taxed.
Paragraph 67 of that judgment states, in language that is now part of the public legal record, that forensic analysis of the WhatsApp communications between Safaricom’s former employees materially reinforces the inference of a sustained and systemic compromise of subscriber data.
The court found that data including financial transaction records, betting activity, device identifiers, and geolocation information had been repeatedly shared through WhatsApp, Google Drive, and email for commercial purposes.
This was facilitated by lax internal controls at Safaricom that left subscriber databases largely unrestricted to employees who wanted access. Safaricom opposed the petition and denied all liability, arguing the breach was the work of rogue former employees acting outside the scope of their employment and disputing claims that millions of subscribers were affected.
However, the court rejected that framing, finding the evidence including forensic material Safaricom itself had produced sufficient to establish that the compromise was systemic rather than incidental.
Crucially for the firms, the judgment and the underlying forensic record do not stop at Safaricom’s door. The court explicitly found that subscriber data was trafficked to named betting firms, and reporting on the case has confirmed that they sit directly inside that evidentiary chain, not as a bystander mentioned in passing, but as an alleged buyer identified through its own COO’s WhatsApp exchanges.
Kabugi’s complaint alleges that the data the firms are said to have purchased covering financial transactions, betting history, device identifiers, and location information allowed the company to sharpen customer acquisition and drive up sales through targeted marketing aimed specifically at people already known to gamble.
He has urged the GRA and the DCI to treat that conduct as unlawful acquisition and use of personal data warranting immediate licence suspension, rather than treating it merely as a civil dispute between Safaricom and its subscribers. The firms named in the wider forensic trail did not respond to questions regarding their appearance in the DCI forensic report, the allegation that they purchased stolen Safaricom subscriber data, or their current data handling practices when those questions were previously put to them by media outlets covering the case.
That silence has persisted even as the regulatory posture around the company has hardened from a civil damages case into a full GRA investigation with licence suspension squarely on the table.
Betika, whose co-founders George Mburu and Chris Mwirigi are separately linked to the same forensic WhatsApp trail, and Kwikbet, also tied directly to Mburu, appear in the same DCI evidentiary record.
However, industry observers have pointed specifically to what has already happened in the case as the baseline template for what regulatory and criminal consequences look like under Kenya’s data protection and gambling laws: an arrested COO, a platform forced dark by court order, and a licence renewal now held hostage to a criminal file.
The GRA has informed Kabugi that its investigation into the licensees named in his complaint remains active and that he will be formally notified once it concludes. For Odibets, that investigation continues to run on parallel tracks.
Aligula remains out on police bond as the criminal case builds around the WhatsApp evidence tying him to the Sh1 million payment. Meanwhile, the company’s licence renewal sits with a regulator now under intense public pressure to demonstrate that a confirmed forensic link to stolen subscriber data carries real legal consequences rather than a quiet administrative approval.
The Sh9.9 million judgment against Safaricom stands as a firm legal foundation that the GRA, the DCI, and future civil claimants can now build directly upon.
Add Comment