As Kenya’s betting industry faces unprecedented scrutiny over data privacy and regulatory compliance, major operators including Betika, Odibets, and Kwikbet have emerged at the center of an expanding investigation into illicit subscriber data acquisition, the report has also been highlighted by the STAR.
The Gambling Regulatory Authority (GRA) has officially confirmed that it is conducting a full investigation into Odibets following allegations that the company purchased the stolen personal data of millions of Safaricom subscribers to artificially inflate its customer base.
This high-profile probe draws directly from a detailed Directorate of Criminal Investigations (DCI) forensic report as well as a landmark High Court judgment that has already cost Safaricom Sh9.9 million in damages.
The regulator’s confirmation follows a formal complaint lodged by businessman Benedict Kabugi Ndungu the original whistleblower who first reported the massive Safaricom data breach to the police in 2019 who explicitly named Odibets, its parent company Kareco Holdings Limited, Betika, and Kwikbet as licensed gambling firms that allegedly received and commercially profited from subscriber information obtained through the breach.
For Odibets, this regulatory scrutiny is no longer a theoretical risk; it is actively unfolding through an executive arrest, a court-ordered platform shutdown, and an upcoming licence renewal that now sits directly in the path of a criminal investigation.
A DCI forensic report at the very center of the case names Odibets as a buyer of the entire Safaricom subscriber database in what investigators describe as an eleven-month criminal conspiracy.
The company is alleged to have acquired stolen data covering roughly 29.9 million Kenyans across multiple separate transactions.
The forensic record is built substantially on WhatsApp communications exchanged between former Safaricom employees and their alleged buyers.
In that evidence table, investigators repeatedly refer to a contact identified only as “Andrew,” a figure the DCI’s own report ties to a confirmed Sh1 million payment from Odibets. One message in the chain asks bluntly whether Odibets would pay for the data, and the forensic record demonstrates that they had already done so.
That contact has since been formally identified as Andrew Akwesera Aligula, listed as chief operating officer and a core shareholder of Kareco Holdings Limited the entity registered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi, which trades publicly as Odibets.
For years, Aligula operated largely out of public view while Jimmy Kibaki, widely reported as the son of the late President Mwai Kibaki, carried the title of chairman and served as the company’s public face.
Aligula’s own public profile was much thinner, limited to brief appearances such as a 2020 SiGMA World panel where he spoke as Odibets’ COO regarding the pandemic’s impact on the gambling market. Company records and investigative reporting describe him as having built a reputation within the industry as untouchable, with extensive reach into Kenya’s political establishment.
Odibets’ bookmaking licence, issued under the newly established Gambling Regulatory Authority of Kenya, was among 99 firms approved for licensing by the Betting Control and Licensing Board for the 2025/2026 financial year.
That administrative approval has now become the exact point of leverage held by the regulator.
With Aligula out on police bond following his arrest and the company’s digital platform having already been forced offline once by court order, Odibets’ licence renewal is no longer a routine administrative step. It represents a critical decision the GRA must navigate while a core shareholder and operational head of the company sits inside an active criminal investigation concerning the exact conduct the licence is meant to certify as clean.
Kabugi’s complaint, officially addressed to DCI boss Mohamed Amin and GRA Director General Peter Maina Karimi, explicitly requests that the regulator suspend Odibets’ operating licence pending the final outcome of its investigation, rather than allowing the renewal cycle to run its ordinary course.
The regulatory and criminal exposure Odibets now faces rests heavily on the High Court judgment in Constitutional Petition E095 of 2026, delivered on May 13, 2026, in which Justice Bahati Mwamuye ruled that Safaricom had violated the constitutional rights of its subscribers.
The court found that Safaricom employees systematically extracted the personal data of 11.5 million subscribers over roughly seven years and trafficked it to third-party betting companies for commercial gain. Eleven petitioners were awarded Sh900,000 each in general damages, totaling Sh9.9 million, with additional costs and interest expected to push the final liability closer to the Sh11 million mark once fully taxed.
Paragraph 67 of that judgment states, in language that is now part of the public legal record, that forensic analysis of the WhatsApp communications between Safaricom’s former employees materially reinforces the inference of a sustained and systemic compromise of subscriber data.
The court found that data including financial transaction records, betting activity, device identifiers, and geolocation information had been repeatedly shared through WhatsApp, Google Drive, and email for commercial purposes.
This was facilitated by lax internal controls at Safaricom that left subscriber databases largely unrestricted to employees who wanted access. Safaricom opposed the petition and denied all liability, arguing the breach was the work of rogue former employees acting outside the scope of their employment and disputing claims that millions of subscribers were affected.
However, the court rejected that framing, finding the evidence including forensic material Safaricom itself had produced sufficient to establish that the compromise was systemic rather than incidental.
Crucially for Odibets, the judgment and the underlying forensic record do not stop at Safaricom’s door. The court explicitly found that subscriber data was trafficked to named betting firms, and reporting on the case has confirmed that Odibets sits directly inside that evidentiary chain, not as a bystander mentioned in passing, but as an alleged buyer identified through its own COO’s WhatsApp exchanges.
Kabugi’s complaint alleges that the data Odibets is said to have purchased covering financial transactions, betting history, device identifiers, and location information allowed the company to sharpen customer acquisition and drive up sales through targeted marketing aimed specifically at people already known to gamble.
He has urged the GRA and the DCI to treat that conduct as unlawful acquisition and use of personal data warranting immediate licence suspension, rather than treating it merely as a civil dispute between Safaricom and its subscribers. Odibets, Kareco Holdings Limited, and its co-defendants named in the wider forensic trail did not respond to questions regarding their appearance in the DCI forensic report, the allegation that they purchased stolen Safaricom subscriber data, or their current data handling practices when those questions were previously put to them by media outlets covering the case.
That silence has persisted even as the regulatory posture around the company has hardened from a civil damages case into a full GRA investigation with licence suspension squarely on the table.Odibets is not alone in Kabugi’s complaint.
Betika, whose co-founders George Mburu and Chris Mwirigi are separately linked to the same forensic WhatsApp trail, and Kwikbet, also tied directly to Mburu, appear in the same DCI evidentiary record.
However, industry observers have pointed specifically to what has already happened to Odibets as the baseline template for what regulatory and criminal consequences look like under Kenya’s data protection and gambling laws: an arrested COO, a platform forced dark by court order, and a licence renewal now held hostage to a criminal file.
That is the sequence Odibets has already lived through, and it is the exact sequence Kabugi’s complaint asks the GRA to apply with equal force to the other operators named alongside it.
The GRA has informed Kabugi that its investigation into the licensees named in his complaint remains active and that he will be formally notified once it concludes. For Odibets, that investigation continues to run on parallel tracks.
Aligula remains out on police bond as the criminal case builds around the WhatsApp evidence tying him to the Sh1 million payment. Meanwhile, the company’s licence renewal sits with a regulator now under intense public pressure to demonstrate that a confirmed forensic link to stolen subscriber data carries real legal consequences rather than a quiet administrative approval.
The Sh9.9 million judgment against Safaricom stands as a firm legal foundation that the GRA, the DCI, and future civil claimants against Odibets itself can now build directly upon.
Add Comment