Questions emerge on betting firms’ shadowy dealings with the regulator and Safaricom

Kenya’s betting industry is facing its most serious credibility test in years, after a High Court judgment and a subsequent regulatory investigation put named betting firms, their controlling directors, and the country’s gambling regulator on the same uncomfortable page as Safaricom’s worst data-governance scandal.

Safaricom’s evidence

On 13 May 2026, Justice Bahati Mwamuye of the High Court’s Constitutional and Human Rights Division delivered judgment in Constitutional Petition E095 of 2026, finding that Safaricom violated the constitutional rights of 11.5 million subscribers after employees extracted and sold their personal data over nearly seven years, beginning no later than June 2018.

The scheme was engineered by Simon Billy Kinuthia, then Safaricom’s Manager for Networks and M-Pesa Systems Auditor, together with Brian Wamatu Njoroge, the telco’s Head of Regional Expansion.

Kinuthia built an algorithm to mine and package subscriber data — identity documents, M-Pesa transaction histories, betting records, device IMEI numbers and constituency-level geolocation — far beyond his authorised access, moving it onto a personal Google Drive that Safaricom has never recovered.

The pair were formally charged in Milimani Chief Magistrate’s Court Criminal Case No. 962 of 2019 with computer fraud and demanding Sh300 million from their own employer.

A third man, Charles Njuguna Kimani, was named as the link to prospective betting-industry buyers, while whistleblower Benedict Kabugi Ndungu — who first alerted Safaricom to the breach in May 2019 — was himself arrested and charged in a separate case that he has long maintained was retaliatory.

The first attempted sale, according to court records, was to Pevans East Africa, trading as SportPesa; that deal collapsed when a Safaricom executive could not guarantee a continuous data feed.

The data was then shopped more widely. Forensic WhatsApp evidence that Safaricom itself placed before the court — expecting it to support a defence that this was the work of rogue employees acting alone — instead named the recipients directly: Andrew Aligula, Odibet, “the Mburus,” Betika, “Charles,” and “the Mule.”

Justice Mwamuye found this was not incidental contact but evidence of what he called a deliberate, organised enterprise monetising subscriber data across the betting sector.

The firms and the men behind them

Odibets, operated through Kareco Holdings Limited and trading out of Parklands, entered the Kenyan market in 2018 — precisely the period covered by the breach. Its co-owner, Andrew Akwesera Aligula, a figure who reportedly kept such a low profile that even industry insiders were largely unaware of his controlling role behind the brand, was reportedly arrested and held at Gigiri Police Station in connection with the forensic findings.

Betika, Kenya’s largest betting platform, is owned and operated by Shop and Deliver Limited, whose board includes co-founder Chris Mwirigi Kaumbuthu — the company’s principal shareholder — alongside George Mburu, co-founder of the affiliated firm Roamtech Solutions Limited, and director John Kiritu.

Both Mburu and Mwirigi are named in the DCI’s forensic WhatsApp analysis, which investigators say shows Betika as a repeat buyer of the stolen dataset across multiple separate transactions rather than a one-off recipient.

Kwikbet, also linked to Mburu through the same forensic trail, appears in the record as a further destination for the data.

From court finding to investigation

The judgment did not stay confined to Safaricom. Benedict Kabugi Ndungu formally petitioned Kenya’s newly established Gambling Regulatory Authority and the Directorate of Criminal Investigations, addressing his complaint to DCI Director Mohamed Amin and GRA Director General Peter Maina Karimi.

Kabugi named Odibets and Kareco Holdings, Betika, and Kwikbet as licensed operators that allegedly received and commercially exploited subscriber data obtained through the breach, and asked the regulator to suspend their licences pending investigation rather than treat the matter as a private dispute between Safaricom and its customers.

The GRA has since confirmed the investigation is live, built on the DCI forensic report and the E095/2026 judgment. The regulator now faces the delicate task of deciding licence renewals for firms whose senior executives are simultaneously under criminal investigation — a test of whether Kenya’s new gambling framework, barely months into its existence, will apply its own “fit and proper person” standards to insiders as rigorously as it applies them to newcomers seeking a licence.

A regulator mid-transition

The scandal has landed squarely in the middle of Kenya’s biggest gambling-oversight overhaul in six decades.

The Betting Control and Licensing Board — the body that regulated the industry, and leaned on Safaricom’s Pay Bill infrastructure to enforce shutdowns, throughout the entire period the data scheme was allegedly running — formally handed its mandate to the Gambling Regulatory Authority in February 2026, under the Gambling Control Act, 2025.

The GRA is now chaired by Joseph Kirui Limo, with Peter Maina Karimi as Director General and board members including Emma Mbugua, Fredrick Odumo Nying’uro and Anne Deraso Illo.

That the old regulator relied so heavily on Safaricom’s payment rails to police illegal betting — while, on the court record, insiders at that same telco were allegedly trading consumer data with licensed operators for years — is what is now prompting hard questions about how much oversight the sector’s institutional relationships actually had, and how much of this the regulator itself was positioned to detect.

What is now at stake

For the 11.5 million affected subscribers, the exposure is direct and ongoing: two of the three laptops onto which the stolen dataset was downloaded remain unaccounted for. A separate class petition, HCCPET No. 247 of 2019, covering the full affected class and seeking up to Sh1.5 million per subscriber — a theoretical exposure north of Sh17 trillion — remains pending.

For Odibets, Betika and Kwikbet, the exposure has moved from reputational risk to active jeopardy: a criminal investigation touching named executives, a licence-renewal process now shadowed by that investigation, and a civil liability question — whether they knowingly bought stolen data — that Kenya’s courts and regulator are no longer positioned to ignore. None of the firms has offered a detailed public response to the allegations.

For Safaricom, the reputational cost compounds an already sensitive period as the company completes its Vodacom shareholding restructuring and operates under a newly issued 25-year Communications Authority licence.

And for the GRA, barely operational since February, the case is an early and very public test of whether Kenya’s rebuilt gambling-oversight architecture will hold industry insiders to the same standard as everyone else.