An ongoing court case in Nairobi has placed one of the country’s most recognizable mobile sports betting platforms, OdiBets, at the centre of a dispute over subscriber data, telecom systems access and the commercial use of records drawn from millions of Kenyans, with the matter now set to test how far the law will go where betting expansion, mobile money activity and private user data meet.
At the centre of the dispute is Kareco Holdings Limited, the entity identified in court material as the corporate operator behind the platform, with its structure, licensing footprint and internal decision-making forming part of the evidentiary record now before the court.
Among those referenced in media-linked ownership and operational reporting connected to Kareco Holdings Limited is Andrew Aligula, who is associated with senior-level roles within the company’s structure and appears in accounts tied to its expansion and operational oversight as the firm scaled its betting operations within Kenya and across regional markets.
Inside the Scope of the Data Breach
Public understanding of the matter has largely revolved around the figure of 11.5 million subscribers, described in filings as Safaricom customers linked to active gambling activity whose betting histories, identity documentation, M-Pesa transaction trails and location-based data were allegedly extracted and circulated.
Court material reviewed by NyakundiReport, however, points to a broader scope.
In a WhatsApp exchange dated 17 July 2018, former Safaricom employee Simon Billy Kinuthia informed his co-accused Brian Wamatu Njoroge:
“I have the full details of our 29.9M Customers backed up somewhere.”
The wording of that message suggests the dataset was already in existence rather than being prepared for future use.
The records attributed to rogue insiders and said to have been extracted from Safaricom systems between June 2018 and May 2019 are described as covering almost the entire telecom subscriber base in Kenya during that period.
According to the material, the data set included:
- Full names
- National identity card numbers
- Passport numbers
- Military identification numbers
alien card numbers - M-Pesa transaction histories
total betting amounts - Gambling behaviour patterns and history
- IMEI numbers linked to devices
dual SIM configuration details - Precise geolocation data mapped to county and locality level
Taken together, the information is described as far more than a standard commercial database.
In practical terms, it functioned as a behavioural and financial profiling system capable of identifying, categorising and targeting users based on vulnerability linked to income patterns, spending behaviour and gambling activity.
What the Forensic Evidence Says About OdiBets
The WhatsApp forensic analysis, taken from the devices of the former Safaricom employees and supplied by Safaricom investigators to the Directorate of Criminal Investigations, names OdiBets directly.
According to court documents reviewed by NyakundiReport, the report lists OdiBets alongside 1Win, SafiBets, Kessbet, Kwikbet and SportPesa as firms that received the illegally obtained subscriber data.
The file does not describe one sale.
It describes repeated releases of subscriber information across an eleven-month period, with datasets shaped in size and segmentation to suit the needs of the buyer firms.
The material shows that the data was not moved in one bulk handover, but sent out in workable chunks.
Forensic evidence points to batches of 100,000 records, 200,000 records and 50,000 records being transmitted separately, with employees negotiating prices, sharing sample datasets with prospective buyers and releasing full databases only after payment or confirmation of purchase.
OdiBets, founded in 2018 and launched in the same year the extraction began, was at the start of its growth path when the data arrived.
The company used the M-Pesa ecosystem as its only payment gateway, making Safaricom subscriber data especially valuable to its targeting model.
A witness statement from Charles Njuguna Kimani, a Safaricom employee implicated in the scheme, gives a view of how the operation worked inside the company.
“On Monday 3rd June, I was called for a meeting with Mr. Ben and Mr. Karauri at Milan Restaurant Westlands. Mr. Karauri asked us to send comprehensive data for use by the company. I passed the message using the normal channel and received the Google Drive link for download.”
The forensic record also shows that on September 11, 2018, at 7:40 in the morning, Wamatu requested the full industry dataset covering 11.5 million gambling subscribers. By 12:21 that afternoon, the transfer had been completed.
Patrick Kinoti Marithi, former head of Safaricom’s ethics and compliance department, gave a sworn statement on June 9, 2019 saying, “I established that the data could be extracted from our computer systems.”
That statement is now part of the prosecution’s forensic file and is among the papers before the court.
Inside the Structure and Regulatory Position of Kareco Holdings
Kareco Holdings Limited is registered and headquartered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi, and operates within Kenya’s regulated betting framework under a licence issued by the Betting Control and Licensing Board, with its licensing position later transitioning under the Gambling Regulatory Authority of Kenya following the Gambling Control Act 2025.
Within the company’s public-facing governance structure, Jimmy Kibaki is listed as chairman and serves as the principal executive figure associated with its brand identity and corporate direction, while Andrew Aligula appears in media-linked and operational references tied to senior-level involvement within the company’s internal decision and expansion framework.
Regulatory filings and industry-facing documentation place the company within a broader East African gambling expansion model, with operations and user acquisition activity extending beyond Kenya into Ghana, Zambia and Zimbabwe, where it reports a combined user base exceeding ten million users across its platforms.
The firm operates within a heavily regulated advertising environment and presents itself as a compliant market participant, maintaining standard responsible gambling disclosures across its digital platforms, including warnings that gambling activity carries addiction risks and guidance advising users to play responsibly.
These disclosures are reinforced through dedicated responsible gambling pages that outline deposit limitation tools, self-management guidance and referral links to support services, forming part of the company’s formal compliance posture within Kenya’s licensing framework.
The commercial trajectory of Kareco Holdings has been closely tied to Kenya’s wider mobile-first betting expansion, with its growth period aligning with rapid adoption of mobile money payments and aggressive digital marketing strategies across urban and peri-urban markets.
Between 2018 and 2022, the wider betting sector recorded gross gaming revenue of Sh88.24 billion, within which Kareco Holdings positioned itself as an early-stage entrant that scaled rapidly through digital acquisition channels and mass-market promotional activity.
The timing of this expansion coincides with the period examined in the court record, where investigative material places the company’s growth phase alongside the emergence of disputed subscriber data flows and the competitive intensification of Kenya’s betting market.
Legal Consequences Facing OdiBets Under Data Protection and Cybercrime Laws
The judgment due on May 13 will be delivered in a constitutional petition filed by Augustine Onalo, acting for 11.5 million affected subscribers and represented by Mola Kimosop Advocates.
The petitioners are seeking Ksh 1.5 million per subscriber in constitutional damages from Safaricom, which places the total claim at a level that runs into trillions of shillings.
For OdiBets, the legal risk sits in a separate and more immediate legal frame tied to data protection and cybercrime enforcement rather than the constitutional claim itself.
Kenya’s Data Protection Act of 2019 came into force on November 25, 2019, after the alleged extraction had already occurred, but during a period when OdiBets is said to have continued using the disputed datasets for commercial targeting and customer acquisition.
The Act provides for administrative penalties of up to Ksh 5 million or, for a corporate entity, up to 1% of annual turnover for the preceding financial year, whichever figure is lower under the statutory formula.
For a company of OdiBets’ scale and reported market reach, 1% of annual revenue could translate into a figure that sits well above the fixed statutory ceiling, depending on audited turnover for the relevant period.
The Office of the Data Protection Commissioner has already demonstrated willingness to enforce these provisions, having issued a maximum Ksh 5 million penalty against Oppo Kenya in December 2022 and ordering compensation measures against Safaricom and Becton Dickinson East Africa in February 2025.
Beyond administrative penalties, the Act also creates room for criminal liability where directors or company officers are found to have wilfully participated in unlawful handling or use of personal data, with custodial sentences provided for under the statute.
The Computer Misuse and Cybercrimes Act further classifies receipt, retention, and commercial use of data obtained through unauthorised access to computer systems as a criminal offence, widening exposure beyond regulatory enforcement.
If the court accepts the forensic material indicating that OdiBets knowingly acquired data originating from Safaricom systems without subscriber consent, the exposure would extend from regulatory sanctions to potential criminal proceedings involving senior company officials.
The Betting Control and Licensing Board, and later the Gambling Regulatory Authority of Kenya, also hold independent powers to impose fines, suspend licences, and initiate revocation proceedings where an operator is found to have relied on unlawfully obtained data.
The BCLB has already demonstrated enforcement strength in 2025, shutting down more than fifty betting firms operating without valid licences and introducing strict advertising rules that prohibit celebrity endorsements and require prior clearance of promotional content.
A finding that OdiBets acquired stolen subscriber data would place the company in a compliance crisis that cuts across regulatory, licensing, and criminal enforcement frameworks simultaneously.
What OdiBets Data Use Means for Affected Users
The logic behind acquiring Safaricom subscriber data is presented as both calculated and exploitative, with the material described as going far beyond basic identifiers such as names and phone numbers.
The datasets are said to have contained detailed behavioural and financial traces, covering each subscriber’s betting history, cumulative amounts staked, frequency of gambling activity, and M-Pesa transaction patterns over time.
When combined with geolocation markers extending to locality level, the information would have allowed a betting operator to map user behaviour with a high degree of precision, identifying those most exposed to gambling, those already deeply engaged, and those statistically more likely to continue betting even after repeated losses, turning what would ordinarily be customer information into structured vulnerability profiling.
Kenya is now widely described as the most gambling-saturated country in Sub-Saharan Africa in terms of participation rates, with a GeoPoll survey across six countries indicating that 83.9% of Kenyan respondents had engaged in gambling activity, the highest proportion recorded in the comparison.
Data cited in the subscriber petition further states that close to 80% of individuals seeking psychiatric treatment in Kenyan health facilities are now classified within problem or pathological gambling categories, pointing to a widening public health burden linked to betting behaviour.
A 2025 study focusing on peri-urban male populations in Kajiado County found that 69% of respondents used gambling as a coping mechanism for economic pressure, while 93.1% reported intense post-gambling regret and 51.7% indicated a deterioration in mental wellbeing associated with their gambling habits.
In 2024 alone, total wagering activity in Kenya reached approximately Ksh 766 billion, a figure that exceeds the national education budget of Ksh 656 billion for the same financial period, while the Kenya Revenue Authority recorded Ksh 13.233 billion in excise duty collections from the betting sector in the 2024/2025 financial year, figures frequently cited by state agencies as evidence of sector contribution to public revenue.
What is not reflected in those fiscal summaries is the wider social impact linked to gambling dependency, which includes individuals losing long-term savings, traders experiencing financial collapse, and households breaking apart under pressure from addiction patterns that, in several cases, are alleged to have been reinforced through targeted use of extracted personal data.
The outcomes associated with gambling-related harm are not confined to statistics, as illustrated in October 2024 when Susan Njeri, a small-scale trader from Kakamega County known locally as Mama Sammy, died by suicide after losing Ksh 60,000 through betting activity.
In the same year, a first-class honours graduate from Maasai Mara University reportedly lost Ksh 900,000 in a single night of betting and later took his own life, with subsequent research published in December 2025 reinforcing long-held observations by addiction specialists that gambling harm in Kenya is concentrated among economically pressured young men drawn into repetitive betting cycles through highly targeted exposure mechanisms.
Addiction counsellor Chrispus Githae Kimaru has previously described the sector as operating in a space where entertainment gives way to dependency formation, arguing that the underlying model relies on sustained psychological pressure rather than casual participation.
Within that framing, the allegation concerning OdiBets is that the platform did not rely on general market outreach alone, but instead accessed intelligence that allowed it to locate and concentrate on users already exhibiting high-risk behavioural patterns, effectively narrowing acquisition strategy toward segments most likely to generate sustained gambling activity.
How OdiBets Drove Rapid Expansion Through Subscriber Profiling and Targeting Systems
This news outlet’s review of OdiBets’ operational history describes a company that has relied heavily on aggressive marketing within a sector that already operates under sustained regulatory pressure, building its expansion from its 2018 launch into a dominant market position through extensive outreach across matatus, print media, and digital channels, while targeting young Kenyans with promotions, free bets, and data bundle incentives designed to reduce both psychological hesitation and financial barriers to entry.
Its marketing identity, commonly captured under the hashtag BetExtraODInary, is framed around a demographic widely exposed to gambling risk, particularly unemployed or underemployed young men in urban and peri-urban areas who view betting as a supplementary income stream rather than purely entertainment.
Independent assessments have described the company’s responsible gambling framework as limited in functionality and largely reactive in design, with a June 2025 review noting the absence of built-in dashboard tools that allow users to set structured daily, weekly, or monthly spending limits within their accounts, and instead requiring customers who wish to self-exclude to go through customer support channels rather than activating an immediate self-service control.
The same review also points out the lack of in-app behavioural safeguards such as reminder prompts or time-out alerts, features that are commonly used in other regulated markets to slow repetitive betting cycles.
While these gaps are not, in themselves, described as unlawful, they sit in sharp contrast to the company’s public positioning on responsible gambling and take on greater weight when considered alongside allegations that the firm’s user acquisition strategy relied on data obtained through unlawful access to subscriber information systems.
In a separate regulatory development, OdiBets became involved in a dispute with Opera Software Ireland Limited, which resulted in the Competition Authority of Kenya directing that the platform be restored after it had been removed from the browser environment and its users diverted toward competing betting services, with the CAK issuing a cease and desist order in June 2024 pending review of the conduct.
That regulatory episode is presented as an example of the lengths to which the company has engaged formal oversight mechanisms in order to maintain and expand its access to the market.
The Upcoming Court Decision and Its Possible Effects
The High Court judgment on May 13 will deal first with the constitutional liability of Safaricom for the conduct of its employees.
But it will do so against a factual record that already names OdiBets as a recipient of illegally obtained data.
Whatever Safaricom’s liability for the breach itself, the forensic report’s naming of OdiBets as a buyer of stolen data is now part of the court record.
If the court accepts the material as credible and admissible, the route to action against OdiBets becomes much clearer.
The DCI, which received the forensic report from Safaricom in 2019, has not brought criminal charges against any of the betting firms named as buyers of the stolen data.
The ODPC has not opened a formal probe into OdiBets’ data handling conduct arising from the theft.
The BCLB, now moving into the Gambling Regulatory Authority of Kenya, has not publicly addressed OdiBets’ place in the forensic record.
Each of those silences becomes harder to maintain once a High Court ruling confirms the evidential basis of the petition.
Legal analysts who have reviewed the case papers say a ruling that accepts the petitioners’ main claims would put direct pressure on the DCI and the Office of the Director of Public Prosecutions to explain why, seven years after the forensic report was filed, no criminal charges have been brought against the firms that bought the stolen data.
The petitioners are seeking Ksh 1.5 million per subscriber from Safaricom, which means a total exposure of Ksh 17.25 trillion for the 11.5 million affected subscribers.
The data of the remaining 18.4 million subscribers whose records were also extracted has not yet been made the subject of a separate claim, though the legal path for such a claim is now plain.
For OdiBets, civil exposure runs to any of the 29.9 million subscribers whose data was accessed and who can show that OdiBets was one of the companies that received and used their information.
What the Evidence Now Demands From the Company
OdiBets has, over time, cultivated a public identity framed around local ownership, community engagement, and alignment with youth-centred aspiration within Kenya’s rapidly expanding digital economy.
Its visibility in the public sphere has been reinforced through sponsorship of grassroots football structures as well as the national amputee football team, positioning the brand within widely followed sporting narratives.
Across its marketing channels and digital platforms, the company presents itself through messaging that stresses responsibility in gambling and consumer-facing safeguards, using familiar cultural references drawn from everyday Kenyan life.
The material now before the Nairobi High Court presents a markedly different account.
It sets out allegations that, at an early stage of its expansion, the business obtained large-scale subscriber intelligence linked to millions of Kenyans through intermediated channels described in the forensic record, and used that information to map, segment and target users with high exposure to financial risk within the gambling ecosystem, enabling rapid commercial growth at scale.
It further sets out claims that such datasets were acquired with knowledge of their origin, notwithstanding that the affected subscribers had no awareness of any extraction or onward commercial use of their personal and transactional information, which included mobile money histories, identity credentials and betting behaviour profiles.
Under Kenya’s regulatory framework, the Gambling Regulatory Authority of Kenya retains authority to examine compliance with licensing conditions, impose administrative sanctions and, where warranted, withdraw operational licences from entities found to have breached statutory requirements.
The Office of the Data Protection Commissioner holds parallel powers to issue enforcement directives, impose financial penalties, order corrective measures and initiate referral for criminal proceedings where violations of data protection law are established.
The Director of Public Prosecutions may, in turn, pursue criminal charges against officers of Kareco Holdings Limited under both the Data Protection Act and the Computer Misuse and Cybercrimes Act where evidential thresholds are met.
Seven years after the forensic material entered official channels, the matter remains unresolved in substantive legal terms.
The forthcoming High Court decision on 13 May is therefore positioned as a key reference point for how far existing legal frameworks extend when tested against large-scale digital data allegations tied to commercial operations.
Any subsequent action by enforcement bodies will determine whether Kenya’s statutory protections carry practical weight in circumstances involving high-volume personal data exposure and commercial exploitation, or whether enforcement remains limited in effect.
