Businessman Benedict Kabugi has been drawn into a major legal fight after being accused of extorting Safaricom and betting firms in a case linked to a huge data breach.
What started as claims of stolen customer information has grown into one of the most serious privacy scandals in Kenya. The case has raised concern about how personal data is handled by large companies and how valuable that data has become in the digital world.
According to court records, the alleged breach involved information belonging to more than 11.5 million Safaricom subscribers.
The data is said to have included names, phone numbers, identity card and passport details, location data, handset records, M-Pesa transaction history, and betting activity.
This kind of information can reveal a great deal about a person’s life, spending habits, and movement. Safaricom says two former senior managers worked with Kabugi to remove the data from its systems between 2018 and 2019.
The company claims the information was moved to password-protected cloud accounts and then copied to personal computers, some of which have not been found.
The telecom company has argued that the data was not just taken for private use, but was meant to be sold to businesses in the betting industry.
In that sector, detailed customer profiles can be very useful because they help companies understand user behaviour and target customers more effectively. This is one reason the case has attracted so much attention.
The scale of the alleged breach is very large, and investigators believe it may have affected nearly a quarter of Safaricom’s customer base at the time.
Safaricom has said Kabugi was not acting as a whistleblower, but as part of the scheme. The company alleges that after the plan to sell the data did not work, Kabugi demanded Sh100 million in exchange for revealing the source of the stolen information and for not making further disclosures.
These claims led to criminal charges involving demanding money with menaces. Kabugi has denied the accusations and says he was the one who exposed serious weaknesses in Safaricom’s data protection systems.
The matter took a major turn in May 2026 when the High Court found Safaricom responsible for violating the constitutional rights of some subscribers whose data had been exposed.
The court said the company could not avoid responsibility by blaming rogue employees alone. It found that subscriber information had been shared outside the company without consent.
Eleven affected subscribers were awarded damages, along with costs and interest. This ruling has become an important step in Kenya’s data privacy law and may influence future cases.
The case has also brought more attention to the growing market for personal data. In a country where mobile money, communication services, and online betting are widely used, personal information can have high commercial value.
Privacy experts have long warned that data such as gambling history, transaction records, and location details can be used to build detailed customer profiles. The Safaricom case has turned those warnings into a real legal and public issue.
For many customers, the scandal is about trust. People give telecom companies their most sensitive information and expect it to be protected. If that trust is broken, the damage can last for years. Safaricom says it has improved its security systems since the breach came to light, but questions remain about the missing devices and whether some of the data may still be circulating.
