An ongoing court case in Nairobi has placed one of the country’s most recognizable mobile sports betting platforms, OdiBets, at the centre of a dispute over subscriber data, telecom systems access and the commercial use of records drawn from millions of Kenyans, with the matter now set to test how far the law will go where betting expansion, mobile money activity and private user data meet.
At the centre of the dispute is Kareco Holdings Limited, the entity identified in court material as the corporate operator behind the platform, with its structure, licensing footprint and internal decision-making forming part of the evidentiary record now before the court.
Among those referenced in media-linked ownership and operational reporting connected to Kareco Holdings Limited is Andrew Aligula, who is associated with senior-level roles within the company’s structure and appears in accounts tied to its expansion and operational oversight as the firm scaled its betting operations within Kenya and across regional markets.
High Court evidence places OdiBets senior executive Andrew Aligula at the centre of claims that subscriber data was used to build targeting systems for rapid expansion.
Public understanding of the matter has largely revolved around the figure of 11.5 million subscribers, described in filings as Safaricom customers linked to active gambling activity whose betting histories, identity documentation, M-Pesa transaction trails and location-based data were allegedly extracted and circulated.
Court material reviewed by NyakundiReport, however, points to a broader scope. In a WhatsApp exchange dated 17 July 2018, former Safaricom employee Simon Billy Kinuthia informed his co-accused Brian Wamatu Njoroge, “I have the full details of our 29.9M Customers backed up somewhere.”
The wording suggests the dataset already existed rather than being prepared later.
The records attributed to rogue insiders and said to have been extracted between June 2018 and May 2019 are described as covering almost the entire telecom subscriber base in Kenya during that period.
According to the material, the dataset included full names, national identity numbers, passport numbers, military identification numbers, alien card numbers, M-Pesa transaction histories, total betting amounts, gambling behaviour patterns, IMEI numbers, dual SIM configurations, and precise geolocation data mapped to county and locality level.
Taken together, the information functioned as a behavioural and financial profiling system capable of categorising users based on income patterns, spending behaviour and gambling exposure.
The WhatsApp forensic analysis, drawn from devices of former Safaricom employees and supplied by investigators to the Directorate of Criminal Investigations, names OdiBets directly alongside 1Win, SafiBets, Kessbet, Kwikbet and SportPesa as firms that received the allegedly illegally obtained subscriber data.
The material does not describe a single transfer but repeated releases of datasets over an eleven-month period, structured in batches of 100,000, 200,000 and 50,000 records depending on buyer requirements. It also indicates that samples were shared during negotiations before full datasets were released after payment or confirmation of purchase.
OdiBets, founded in 2018 and launched during the same period the extraction is alleged to have occurred, was in its early expansion phase when the data is said to have been used. The company relied on the M-Pesa ecosystem as its primary payment gateway, making Safaricom subscriber intelligence particularly valuable for customer acquisition targeting.
A witness statement from Charles Njuguna Kimani, a Safaricom employee implicated in the case, describes an alleged coordination process involving company representatives.
He stated, “On Monday 3rd June, I was called for a meeting with Mr. Ben and Mr. Karauri at Milan Restaurant Westlands. Mr. Karauri asked us to send comprehensive data for use by the company. I passed the message using the normal channel and received the Google Drive link for download.” The forensic record further shows that on September 11, 2018, at 7:40 a.m., Wamatu requested the full industry dataset covering 11.5 million gambling subscribers, with transfer completion recorded later that day.
Patrick Kinoti Marithi, former head of Safaricom’s ethics and compliance department, stated in a sworn affidavit on June 9, 2019, that “I established that the data could be extracted from our computer systems.” That statement now forms part of the prosecution file before the court.
Kareco Holdings Limited is registered in Nairobi at Plot No. LR 209/2167, Crescent Lane, Parklands, and operates under a betting licence issued by the Betting Control and Licensing Board, later transitioning into regulation under the Gambling Regulatory Authority of Kenya. Within its governance structure, Jimmy Kibaki is listed as chairman while Andrew Aligula appears in operational and media-linked references tied to senior management involvement during its growth phase.
The company expanded beyond Kenya into Ghana, Zambia and Zimbabwe, reporting a user base exceeding ten million across markets. Its growth coincided with rapid mobile money adoption and aggressive digital marketing in Kenya’s betting sector, which recorded Sh88.24 billion in gross gaming revenue between 2018 and 2022.
The legal dimension of the case is tied to a constitutional petition filed on behalf of 11.5 million subscribers seeking damages from Safaricom, with broader implications for firms named in the forensic record. Although the alleged extraction predates the Data Protection Act of 2019, the law may still apply to subsequent use of the data. It allows penalties of up to Ksh 5 million or 1 percent of annual turnover for corporate entities, along with possible criminal liability for directors involved in unlawful processing.
The Computer Misuse and Cybercrimes Act also provides criminal sanctions for possession or commercial use of data obtained through unauthorised access. Regulators including the Office of the Data Protection Commissioner and the Gambling Regulatory Authority of Kenya retain powers to impose fines, suspend licences or initiate revocation proceedings depending on findings.
The evidence raises broader questions about how subscriber data may have influenced betting platform growth in Kenya’s rapidly expanding gambling market, where mobile-first acquisition strategies have played a central role. Kenya’s gambling participation rates remain among the highest in Sub-Saharan Africa, with surveys indicating widespread engagement across demographics. In 2024, total wagering activity reached an estimated Ksh 766 billion, reflecting the scale of the industry alongside rising concerns about addiction and financial harm.
Public health data has also linked gambling behaviour to increasing mental health challenges among young users, particularly in urban and peri-urban regions.
The High Court is expected to deliver its ruling on May 13, a decision that will determine Safaricom’s constitutional liability but may also shape how investigators and regulators proceed against firms named in the forensic record, including OdiBets.
Add Comment