Following years of legal fallout over a massive telecom data leak, Kenya’s Gambling Regulatory Authority (GRA) has confirmed a full-scale investigation into Odibets after formal complaints lodged by whistleblower Benedict Kabugi Ndungu. Kabugi, who first alerted police to the widespread Safaricom breach back in 2019, has officially petitioned DCI chief Mohamed Amin and GRA Director General Peter Maina Karimi. He explicitly accuses Odibets, its parent company Kareco Holdings Limited, as well as fellow gambling operators Betika and Kwikbet, of purchasing and commercially exploiting stolen subscriber details to artificially inflate their customer bases a development heavily featured in recent coverage by The Star.
This escalating probe draws heavily on an exhaustive Directorate of Criminal Investigations (DCI) forensic analysis detailing an eleven-month criminal conspiracy. According to the DCI, Odibets acted as a direct purchaser of Safaricom’s subscriber database, allegedly acquiring stolen personal information belonging to roughly 29.9 million Kenyans across multiple illicit transactions.
The investigative record relies significantly on recovered WhatsApp messages, Google Drive links, and emails exchanged between former Safaricom employees and their commercial buyers.
Within these forensic evidence logs, investigators repeatedly tracked a key contact designated as “Andrew,” linking him to a confirmed Sh1 million payment disbursed by Odibets. Messages within the chat threads explicitly discuss payment terms for the data, with digital evidence showing the funds had already been transferred. Authorities have since identified this contact as Andrew Akwesera Aligula, the Chief Operating Officer and major shareholder of Kareco Holdings Limited—the corporate entity registered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi, which operates publicly under the Odibets brand.
While Jimmy Kibaki, son of the late President Mwai Kibaki, publicly served as Odibets’ chairman and visible figurehead, Aligula operated largely behind the scenes. His public footprint was sparse, save for a brief appearance at a 2020 SiGMA World panel discussing the pandemic’s impact on betting, though industry insiders long regarded him as an untouchable figure with deep ties to the political establishment.
Today, however, that perceived protection has unraveled. With Aligula out on police bond following his arrest and Odibets’ digital platform already knocked offline once by a court directive, the company’s regulatory standing has shifted from a hypothetical risk to an active crisis.
Although Odibets was initially included among 99 firms approved for bookmaking licences by the Betting Control and Licensing Board for the 2025/2026 financial year, that administrative nod has transformed into crucial leverage for the GRA.
Kabugi’s complaint explicitly demands that regulators suspend Odibets’ operating licence immediately while criminal investigations proceed, rather than treating its renewal as a routine formality.
The GRA now faces immense pressure to make a definitive ruling while the operational head and primary owner of a licensed firm remains under criminal investigation for the very practices the licence is meant to regulate.
The legal foundation for this regulatory crackdown rests solidly upon a groundbreaking High Court judgment in Constitutional Petition E095 of 2026, delivered by Justice Bahati Mwamuye on May 13, 2026.
The court ruled that Safaricom violated its subscribers’ constitutional rights, finding that company employees systematically extracted the personal records of 11.5 million users over a seven-year period to traffic them to gambling companies for financial gain.
Safaricom was ordered to pay Sh900,000 to each of the eleven petitioners, totaling Sh9.9 million in general damages, with legal costs and interest expected to push the final payout closer to Sh11 million.
In Paragraph 67 of the ruling, Justice Mwamuye noted that forensic evaluations of WhatsApp conversations between former Safaricom staff strongly reinforced the conclusion of a sustained and systemic breach. The compromised information spanned financial transaction histories, betting records, device identification numbers, and real-time geolocation data.
The court firmly rejected Safaricom’s defense that the leak was merely the isolated work of rogue employees acting beyond their duties, holding that lax internal security left sensitive subscriber databases largely exposed to unauthorized internal access.
The High Court judgment and supporting DCI files demonstrate that subscriber data flowed directly into the hands of specific gambling firms, placing Odibets at the center of the evidentiary chain through its COO’s direct communications.
Kabugi’s complaint highlights that this stolen data allowed Odibets to refine its customer acquisition strategies and maximize revenue by running aggressive, targeted marketing campaigns aimed at known gamblers. When media outlets previously confronted Odibets, Kareco Holdings Limited, and co-defendants about their inclusion in the DCI report and their data privacy protocols, the firms maintained complete silence a posture that persists even as civil damages evolve into potential regulatory shutdown.
Odibets is not the sole operator implicated in Kabugi’s submission. The same DCI forensic records link Betika co-founders George Mburu and Chris Mwirigi to the identical WhatsApp evidence chain, while Kwikbet is similarly tied directly to Mburu. Industry analysts view the severe repercussions hitting Odibets an arrested COO, court-ordered platform outages, and a stalled operating licence as the benchmark for how Kenya’s data protection and gambling laws will be enforced going forward. Kabugi has urged the GRA to apply these exact enforcement measures to Betika and Kwikbet as well.
The GRA has officially notified Kabugi that its investigation into all named licensees remains active and that formal findings will be released upon completion.
For Odibets, the situation continues to unfold along two high-stakes tracks: Aligula remains on police bond while criminal prosecutors build their case around the Sh1 million transaction, while the company’s licence renewal hangs in the balance before a regulator under intense public demand for accountability.
The landmark Sh9.9 million High Court verdict against Safaricom provides a legal bedrock upon which authorities, regulators, and future civil litigants can directly hold these betting operators accountable.
