Following years of legal fallout over a massive telecom data leak, Kenya’s Gambling Regulatory Authority (GRA) has confirmed a full-scale investigation into betting firms after formal complaints lodged by whistleblower Benedict Kabugi Ndungu.
Kabugi, who first alerted police to the widespread Safaricom breach back in 2019, has officially petitioned DCI chief Mohamed Amin and GRA Director General Peter Maina Karimi.
He explicitly accuses gambling operators Betika and Kwikbet, of purchasing and commercially exploiting stolen subscriber details to artificially inflate their customer bases a development heavily featured in recent coverage by The Star.
This escalating probe draws heavily on an exhaustive Directorate of Criminal Investigations (DCI) forensic analysis detailing an eleven-month criminal conspiracy. According to the DCI, the firms acted as a direct purchaser of Safaricom’s subscriber database, allegedly acquiring stolen personal information belonging to roughly 29.9 million Kenyans across multiple illicit transactions.
The investigative record relies significantly on recovered WhatsApp messages, Google Drive links, and emails exchanged between former Safaricom employees and their commercial buyers.
Kabugi’s complaint explicitly demands that regulators suspend the firms’ operating licenses immediately while criminal investigations proceed, rather than treating its renewal as a routine formality.
The GRA now faces immense pressure to make a definitive ruling while the operational head and primary owner of a licensed firm remains under criminal investigation for the very practices the licence is meant to regulate.
The legal foundation for this regulatory crackdown rests solidly upon a groundbreaking High Court judgment in Constitutional Petition E095 of 2026, delivered by Justice Bahati Mwamuye on May 13, 2026.
The court ruled that Safaricom violated its subscribers’ constitutional rights, finding that company employees systematically extracted the personal records of 11.5 million users over a seven-year period to traffic them to gambling companies for financial gain.
Safaricom was ordered to pay Sh900,000 to each of the eleven petitioners, totaling Sh9.9 million in general damages, with legal costs and interest expected to push the final payout closer to Sh11 million.
In Paragraph 67 of the ruling, Justice Mwamuye noted that forensic evaluations of WhatsApp conversations between former Safaricom staff strongly reinforced the conclusion of a sustained and systemic breach. The compromised information spanned financial transaction histories, betting records, device identification numbers, and real-time geolocation data.
The court firmly rejected Safaricom’s defense that the leak was merely the isolated work of rogue employees acting beyond their duties, holding that lax internal security left sensitive subscriber databases largely exposed to unauthorized internal access.
The High Court judgment and supporting DCI files demonstrate that subscriber data flowed directly into the hands of specific gambling firms, placing Odibets at the center of the evidentiary chain through its COO’s direct communications.
Kabugi’s complaint highlights that this stolen data allowed the firms to refine their customer acquisition strategies and maximize revenue by running aggressive, targeted marketing campaigns aimed at known gamblers. When media outlets previously confronted the firms, they maintained complete silence a posture that persists even as civil damages evolve into potential regulatory shutdown.
The same DCI forensic records link Betika co-founders George Mburu and Chris Mwirigi to the identical WhatsApp evidence chain, while Kwikbet is similarly tied directly to Mburu. Industry analysts view the severe repercussions hitting the firms, court-ordered platform outages, and a stalled operating licence as the benchmark for how Kenya’s data protection and gambling laws will be enforced going forward. Kabugi has urged the GRA to apply these exact enforcement measures to Betika and Kwikbet as well.
The GRA has officially notified Kabugi that its investigation into all named licensees remains active and that formal findings will be released upon completion.
The landmark Sh9.9 million High Court verdict against Safaricom provides a legal bedrock upon which authorities, regulators, and future civil litigants can directly hold these betting operators accountable.
