Betika and Odibets Executives Detained over Data Case

In Short

Kenyan authorities have detained senior executives linked to a case involving alleged theft and commercial use of Safaricom subscriber data. The detentions follow a High Court ruling that backed a long running complaint first filed in 2019.

What Happened

A Kenyan High Court ruling dated 13 May confirmed that a 2019 complaint had reported a Safaricom data breach to police and regulators.

The court findings said Betika, operating under the trading name Shop and Deliver Limited, obtained personal data through former Safaricom employees. The complaint was submitted to the Directorate of Criminal Investigations and to Kenya’s Gambling Regulatory Authority.

Investigators say the exposed data could affect up to 29.9 million Safaricom customers. The alleged dataset includes full names, national ID numbers, M-Pesa transaction histories (mobile money transfers), geolocation data (where a phone was), IMEI numbers (a unique phone device identifier), betting patterns, and deposit and withdrawal details.

Authorities say forensic review of WhatsApp communications helped identify what they describe as a systemic compromise of subscriber data.

Following the investigation, Betika founders George Mburu and Chris Mwirigi were detained by police. They face multiple criminal charges, including handling stolen user data, computer related fraud, money laundering, and conspiracy to commit a felony.

An executive at Odibets, Andrew Alingula, has also been detained. The allegation is that Odibets commercially received and used the same stolen Safaricom subscriber data.

Why It Matters

This case signals tighter enforcement of data protection and gambling oversight in Kenya. It also highlights how telecom and mobile money records can become high value targets, because they link identity, location, and financial behaviour.

For betting and fintech operators that rely on telecom data, the message is clear. Data sourcing, access controls, and audit trails need to be provable, not assumed. For consumers, the alleged scope shows how a single breach can expose both identity details and transaction histories.