Kenya’s betting industry is under intense scrutiny after the Gambling Regulatory Authority (GRA) confirmed it is investigating betting firms over allegations that it purchased stolen Safaricom subscriber data to grow its customer base.
Betika and Kwikbet have also been named in the wider investigation, which has also been highlighted by The Star.
The investigation follows a formal complaint by businessman Benedict Kabugi Ndungu, the whistleblower who first reported the Safaricom data breach to police in 2019.
In his complaint, Kabugi named Betika, and Kwikbet as licensed betting firms that allegedly received and commercially benefited from subscriber information obtained through the breach.
According to the GRA, the investigation is based on a Directorate of Criminal Investigations (DCI) forensic report and a High Court judgment that ordered Safaricom to pay Sh9.9 million in damages over the unlawful handling of subscriber data.
For the firms, the matter has moved beyond allegations. The company is now facing an active regulatory investigation alongside a criminal probe involving one of its senior executives. Their licence renewal has also come under close attention as the investigations continue.
A DCI forensic report identifies the firms as some of the alleged buyers of the Safaricom subscriber database in what investigators describe as an eleven-month criminal conspiracy.
Investigators claim the company acquired stolen data covering about 29.9 million Kenyans through several separate transactions.
Much of the forensic evidence is drawn from WhatsApp conversations exchanged between former Safaricom employees and the alleged buyers of the data.
The GRA must now determine the company’s future while a key executive remains under criminal investigation.
Kabugi’s complaint, addressed to DCI Director Mohamed Amin and GRA Director General Peter Maina Karimi, asks the regulator to suspend the firms’ license until investigations are completed.
The case also relies heavily on the High Court judgement in Constitutional Petition E095 of 2026, delivered on May 13, 2026, where Justice Bahati Mwamuye ruled that Safaricom violated the constitutional rights of its subscribers.
The court found that Safaricom employees extracted personal data belonging to 11.5 million subscribers over nearly seven years before supplying it to third-party betting firms for commercial purposes.
Eleven petitioners were awarded Sh900,000 each, bringing the total damages to Sh9.9 million, with additional costs and interest expected to increase the amount.
Paragraph 67 of the judgement states that forensic analysis of WhatsApp conversations between former Safaricom employees reinforced the finding that subscriber data had been systematically compromised.
According to the court, financial transaction records, betting history, device identifiers, and location information were repeatedly shared through WhatsApp, Google Drive, and email for commercial use.
The court further found that weak internal controls at Safaricom allowed employees broad access to subscriber databases.
Safaricom denied responsibility and argued that rogue former employees acted independently while disputing claims that millions of subscribers were affected.
However, the court rejected that argument and ruled that the available forensic evidence, including material produced by Safaricom itself, showed the breach was widespread rather than isolated.
For the beting firms, the judgment extends beyond Safaricom because the court found that subscriber information was passed to named betting firms. Reporting on the case has placed them within that chain of evidence as an alleged buyer identified through WhatsApp conversations involving their top executives.
Kabugi’s complaint alleges that the data the firms are accused of obtaining, including financial records, betting history, device identifiers, and location information, helped the company improve customer acquisition and increase sales through targeted marketing aimed at existing gamblers.
He has urged the GRA and the DCI to treat the alleged conduct as unlawful acquisition and use of personal data that justifies immediate licence suspension rather than treating it only as a civil dispute involving Safaricom and its subscribers.
The firms named in the wider forensic investigation did not respond to media questions about their appearance in the DCI report, the allegations that they bought stolen Safaricom subscriber data, or their data handling practices.
Even as regulatory action has intensified, that position has remained unchanged, with the matter now progressing into a full GRA investigation where licence suspension remains a possibility.
Betika, whose co-founders George Mburu and Chris Mwirigi are separately linked to the same forensic WhatsApp evidence, together with Kwikbet, which is also linked to Mburu, appear in the same DCI forensic record.
Industry observers say the developments involving the firms provide an indication of the possible regulatory and criminal consequences under Kenya’s data protection and gambling laws.
Those developments include the arrest of its COO, a court-ordered shutdown of its platform, and a licence renewal now being considered alongside an active criminal investigation.
Kabugi’s complaint urges the GRA to apply the same level of scrutiny to all the betting firms named in the investigation.
The GRA has informed Kabugi that investigations into the betting companies named in his complaint remain ongoing and that he will receive formal communication once they are concluded.
At the same time, the firms’ licence renewal remains before the regulator, which is under growing public pressure to demonstrate that confirmed forensic links to stolen subscriber data carry meaningful legal consequences.
The High Court’s Sh9.9 million judgment against Safaricom now provides a legal foundation that the GRA, the DCI, and any future civil claims involving the firms may rely on as the investigations continue.
