There is a particular class of operators who rise to the summit of informal power structures not through the transparency of public office or the scrutiny of regulated commerce, but through a carefully cultivated mythology of protection, an aura so deliberately constructed and so consistently reinforced over years of impunity that the mythology eventually becomes indistinguishable from reality.
Andrew Aligula was that kind of man, and the day it shattered came without warning, without ceremony, and without the political rescue he had every reason, based on years of evidence, to believe would arrive.
Aligula, the feared shadow co-owner of Odibets and one of the most quietly influential figures in Kenya's multi-billion-shilling betting industry, was arrested weeks ago in circumstances that have since become the subject of intense speculation across both the gambling sector and the political circles in which he operated with considerable comfort.
He spent harrowing nights in a cold cell at Gigiri Police Station, a location whose associations with senior-level detentions only amplified the signal that something fundamental had shifted in the calculations of those at the very top of Kenyan power.
The high-flying gambling tycoon who had silently controlled vast swathes of the sector through ruthless influence and alleged dark networks received the shock of his life when police swooped in, and the shock was compounded, almost immediately, by a realization far more devastating than the arrest itself: that the protection he had long believed to be ironclad had, in the critical moment, dissolved entirely.
His desperate calls to President William Ruto went unanswered.
His powerful political ally, Kapseret MP Oscar Sudi, reportedly made representations to the Head of State on Aligula's behalf and was left stunned when the President declined to intervene.
The myth of Aligula's untouchability, which he had openly maintained and which many within the industry had accepted as an operating reality, lay in ruins before the week was out.
On the very day of Aligula's arrest, as news of his detention rippled through Kenya's betting community via WhatsApp groups, Telegram channels, and the interconnected grapevine of the gambling industry, something else happened that transformed a significant story into a full-blown crisis narrative.
The Odibets application went completely offline, remaining inaccessible for over five hours and locking out thousands of punters who depended on the platform's continuous availability to place bets, withdraw winnings, and monitor accounts they had funded with real money.
The timing was, at minimum, extraordinary, and the betting forums did not hesitate to draw the most dramatic possible conclusions.
Speculation erupted across digital communities that the empire was already imploding from within, that the arrest of a key figure had triggered cascading operational failure, or that authorities had taken direct action against the platform's infrastructure as part of a broader intervention.
Odibets issued no explanation that satisfied the public appetite for clarity, and the silence itself became part of the story, feeding a cycle of rumour and anxiety that extended well beyond the company's own user base to encompass the entire industry, which suddenly found itself contemplating what the detention of a figure of Aligula's stature might portend for the sector as a whole.
For years, Odibets had built a formidable and largely unassailable presence in Kenya's highly competitive betting market, attracting millions of users and positioning itself among the country's most recognizable gambling brands through aggressive marketing, technological investment, and a brand proposition that was simultaneously aspirational and accessible.
The platform's outage, however brief, was therefore not merely a technical inconvenience but a symbolic rupture in the image of invincibility that the company had so carefully maintained.
The Court Ruling That Changed the Terrain ¶
To understand why Aligula's arrest carries the weight it does, and why the implications extend so far beyond the detention of any single person, it is necessary to trace the legal and investigative thread that has been tightening around Odibets for months, culminating in a High Court ruling delivered on May 13, 2026 that has fundamentally altered the regulatory and criminal landscape surrounding Kenya's betting industry.
The ruling, delivered at a High Court in Nairobi, concerned a constitutional petition brought by advocate Augustine Onalo representing 11.5 million Safaricom subscribers whose personal data was allegedly stolen, sold, and commercially exploited between 2018 and 2019 in what forensic investigators have described as one of the most consequential data breaches in Kenyan corporate history.
The petitioners, prosecuted by Mola Kimosop Advocates, sought Ksh 1.5 million per subscriber in constitutional damages from Safaricom, the telecommunications giant whose internal systems were allegedly compromised by rogue employees who extracted and monetised subscriber data on an industrial scale for nearly a year before the theft was detected.
The ruling has since become the foundation upon which multiple government agencies, law enforcement and regulatory authorities are being called to conduct comprehensive investigations into the betting sector, examining whether firms that allegedly purchased stolen subscriber data did so knowingly, whether that data was used to commercially target Kenyan citizens without their knowledge or consent, and whether the executives and directors of those firms bear personal criminal liability under Kenya's evolving digital governance framework.
The matter has generated sustained public interest precisely because it touches on the intersection of two issues that Kenyans feel with particular intensity: the security of their personal information in an era of ubiquitous mobile money and digital platforms, and the accountability of powerful commercial actors who have long appeared to operate above the reach of regulation.
The True Scale of the Theft: Nearly Thirty Million Records ¶
Public understanding of the Safaricom data scandal had, until the May 13 ruling focused fresh attention on court documents, been anchored to the figure of 11.5 million subscribers — the number of Safaricom customers identified as active gamblers whose betting histories, identity documents, M-Pesa transaction records, and geolocation data were extracted from the company's systems and sold to betting operators.
Court documents now reveal that the true scope of the data heist was almost three times larger, encompassing records that represent a comprehensive surveillance dossier on nearly the entire Kenyan telecommunications user base at the time of the theft.
In a WhatsApp exchange dated July 17, 2018, former Safaricom employee Simon Billy Kinuthia sent a message to his co-conspirator Brian Wamatu Njoroge that should disturb every Kenyan who has ever registered a SIM card, conducted an M-Pesa transaction, or trusted a telecommunications company with their personal information.
Kinuthia stated, without apparent anxiety or hesitation, that he had the full details of 29.9 million customers backed up and available for distribution.
This was not a boast about capability or future intention; the data had already been extracted from Safaricom's servers and was sitting, ready for sale, in the hands of people who understood precisely what it was worth to companies whose business models depended on knowing which Kenyans gambled, how much they wagered, how often they lost, and how they responded to targeted commercial outreach.
What Kinuthia and his collaborators pilfered from Safaricom's infrastructure between June 2018 and May 2019 was not a database of names and phone numbers but a precision intelligence resource of extraordinary commercial value, encompassing full names, national identity card numbers, passport numbers, military identification numbers, alien card numbers, M-Pesa transaction histories stretching back years, total betting amounts, gambling frequency patterns, handset IMEI numbers, dual SIM specifications, and subscriber geolocation data accurate to the county and locality level.
In the hands of a betting company with the analytical capability to process such information, this dataset was not a marketing tool in any conventional sense but a mechanism for identifying the most financially exposed, psychologically vulnerable, and behaviourally predictable gamblers in the country with a precision that no conventional marketing campaign could approach.
Forensic Evidence and the Naming of OdiBets ¶
The WhatsApp forensic analysis, extracted from the devices of the former Safaricom employees by investigators and supplied by Safaricom itself to the Directorate of Criminal Investigations (DCI), does not speak in abstractions or generalities. It names companies.
According to court documents reviewed by journalists covering these proceedings, the forensic report lists Odibets alongside Betika, Kwikbet, and SportPesa as firms that received the illegally obtained subscriber data, a finding that transforms what might otherwise be a corporate negligence story into something considerably more serious under Kenyan criminal law.
The document does not describe a single, opportunistic transaction conducted in a moment of commercial recklessness.
It describes multiple distributions of subscriber information across an eleven-month period, with datasets tailored in scale and segmentation to match the specific commercial requirements and financial capacity of individual purchasing firms.
The stolen data was parcelled out in commercially convenient tranches, with subsets of 100,000 records, 200,000 records, and 50,000 records distributed separately, with rogue Safaricom employees negotiating prices, supplying sample datasets to prospective buyers as proof of the product's quality and specificity, and transmitting full databases only upon receipt of payment or formal confirmation of purchase.
This was not opportunism. It was an organised and commercially sophisticated illicit market operating within the shell of one of Kenya's most trusted corporations.
A witness statement from Charles Njuguna Kimani, a Safaricom employee implicated in the scheme, provides a particularly illuminating window into how deeply embedded the operation was within the company's internal culture and how routine the extraction and sale of data had become for those involved.
Kimani described being summoned to a meeting at Milan Restaurant in Westlands, where he was asked by senior figures to send comprehensive data for use by the company, after which he passed the request through what he described as the normal channel and received a Google Drive link for download.
The language of normalcy that permeates this account is among its most disturbing features, suggesting that the extraction and forwarding of subscriber data had, for those involved, ceased to feel like a criminal act and had become simply another task in the operational rhythm of the day.
Forensic records establish that on September 11, 2018, at 7:40 in the morning, Wamatu sent a request for the entire gambling industry dataset covering 11.5 million subscribers, and by 12:21 that same afternoon, the transfer was complete.
Patrick Kinoti Marithi, the former head of Safaricom's ethics and compliance department, provided a sworn statement in which he acknowledged that he had established that the data could be extracted from the company's computer systems, a confirmation that forms part of the prosecution's forensic record and sits with uncomfortable weight alongside his title and his department's stated mandate.
Kareco Holdings, Jimmy Kibaki and the Architecture of Odibets
Odibets is the trading name of Kareco Holdings Limited, registered and headquartered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi, a company that operates under a Betting Control and Licensing Board licence and, following the enactment of the Gambling Control Act 2025, holds a bookmaking licence under the newly established Gambling Regulatory Authority of Kenya.
Jimmy Kibaki, reportedly the son of the late President Mwai Kibaki, serves as the company's chairman and is its most publicly visible executive, the face that has historically been presented to regulators, advertisers, and the media when Odibets required a credible and socially connected public representative.
Andrew Aligula occupied a very different position within this architecture, operating as a shadow co-owner whose influence over the company's direction, relationships, and competitive strategies was, by multiple accounts, at least as strong as that of the publicly named leadership, while his profile remained deliberately low and his formal corporate role sufficiently ambiguous to insulate him from the kind of attention that attaches to named directors.
The firm has expanded significantly beyond Kenya's borders into Ghana, Zambia, and Zimbabwe, and claims a user base exceeding ten million customers across East Africa, a figure that reflects both the scale of its operational investment and the effectiveness of its customer acquisition strategy during a period when the forensic evidence suggests it had access to an extraordinary intelligence advantage over its competitors.
The company's rise was built on aggressive and pervasive marketing across matatus, print media, billboards, and digital platforms, all of it targeted with particular intensity at young Kenyans whose economic circumstances made betting an attractive proposition and whose demographic profile overlapped almost precisely with the subscribers most comprehensively documented in the stolen Safaricom datasets.
Odibets grew to become one of the dominant players in a sector where gross gaming revenue totalled Ksh 88.24 billion between 2018 and 2022, a growth trajectory that the DCI forensic timeline suggests was given its initial momentum at precisely the moment the stolen data arrived, providing the company with a competitive intelligence advantage over established rivals such as SportPesa, Betin, and Betika that no legitimate marketing operation could have replicated.
Its website carries standard responsible gambling disclaimers, including the assurance that gambling can be addictive and the encouragement to play responsibly, alongside a dedicated responsible gambling page with advice on deposit limits and addiction resources.
A June 2025 assessment noted that Odibets does not provide built-in tools for users to set daily, weekly, or monthly spending limits from their account dashboard, that users seeking self-exclusion must contact customer support rather than using a self-service mechanism, and that there are no in-app reminders or time-out alerts.
These gaps are not illegal in isolation, but they sit in contrast to the company's public assurances of responsible operation and become more troubling when placed alongside the allegation that the company's foundational customer acquisition strategy was built on data obtained through unlawful means about the financial vulnerabilities, betting histories, and psychological susceptibilities of millions of Kenyans.
The Weight of the Law ¶
The legal exposure that Odibets now faces spans multiple frameworks simultaneously, each carrying its own timeline, its own enforcement mechanism, and its own potential consequences for the company's future as a licensed operator in Kenya.
Kenya's Data Protection Act of 2019 came into force on November 25 of that year, after the period of data theft had concluded but while Odibets was, according to the forensic evidence, still actively using the stolen datasets for commercial targeting purposes.
The Act provides for administrative fines of up to Ksh 5 million or, in the case of a business entity, up to one percent of annual turnover for the preceding financial year, whichever is lower, and for a company of Odibets' scale and revenue, the one percent calculation could represent a penalty more substantial than the statutory ceiling. Beyond administrative sanctions, the Act creates criminal liability for directors and company officers who have committed wilful violations of data protection provisions, opening the prospect of imprisonment for persons who can be shown to have knowingly directed or permitted the commercial use of illegally obtained subscriber information.
The Computer Misuse and Cybercrimes Act adds a further dimension to the exposure, criminalising the receipt and commercial use of data obtained through unauthorised access to computer systems, which is precisely what the Safaricom data represented from the moment it was extracted by rogue insiders and transferred to external parties.
The Gambling Regulatory Authority of Kenya possesses independent powers to impose fines, suspend licences, and initiate revocation proceedings against operators found to have acquired data through illegal means, powers that sit alongside the criminal enforcement framework and that could, in a worst-case scenario for the company, result in the termination of its ability to operate in the Kenyan market entirely.
The Office of the Data Protection Commissioner has demonstrated both the willingness and the institutional capacity to enforce these provisions, having issued its first maximum penalty of Ksh 5 million against Oppo Kenya in December 2022 and having ordered compensation against Safaricom and Becton Dickinson East Africa in February 2025.
The BCLB's successor authority also demonstrated its regulatory determination in 2025, shutting down more than fifty betting firms operating without proper licences and introducing strict advertising guidelines banning celebrity endorsements and requiring pre-approval of all promotional materials, a signal that the era of light-touch oversight that characterised Kenya's betting sector in its formative years has given way to something more demanding.
Vulnerability Profiles and the Industrialization of Desperation
To understand what is at stake in this case, it is necessary to move beyond the legal and regulatory dimensions and examine what the purchase and use of the stolen Safaricom data actually enabled, and what the human consequences of that enabling have been for the millions of Kenyans who were targeted through it without their knowledge or consent.
The stolen datasets did not merely contain names and phone numbers that could be used to send marketing messages to potential customers in the way that any legitimate direct marketing operation might. They contained each subscriber's complete betting history, their total amounts wagered across years of gambling activity, their frequency and patterns of play, their M-Pesa transaction histories revealing income levels, spending patterns, and periods of financial stress, and their geolocation data accurate enough to identify not merely the city in which they lived but the specific locality and neighbourhood.
Combined with analytical tools capable of processing such granular information at scale, this dataset allowed a betting company to identify with statistical precision which Kenyans were the most financially exposed, the most psychologically dependent on gambling as a coping mechanism, and the most likely to continue wagering regardless of losses and personal consequences.
These were not marketing leads in any conventional commercial sense. They were vulnerability profiles — comprehensive intelligence dossiers on the psychological and financial weaknesses of millions of citizens, assembled without their knowledge from data they had provided to a telecommunications company under the expectation of confidentiality, and sold to commercial operators whose business models depended on the continued participation of people who could not afford to stop.
Kenya is now the most gambling-saturated nation in Sub-Saharan Africa by participation rate, with a GeoPoll survey of six African countries finding that 83.9% of Kenyans polled had gambled, the highest proportion recorded across the study.
According to figures cited in court documents filed in the subscriber data petition, nearly 80% of respondents seeking psychiatric treatment at Kenyan institutions are now classified as problem or pathological gamblers, a proportion that demands serious examination of how the country arrived at this point and what commercial and technological forces accelerated the journey.
In 2024, Kenyans bet a total of Ksh 766 billion, a figure that surpasses Kenya's entire national education budget of Ksh 656 billion for the same period and that represents a diversion of economic resources from productive activity into a sector whose profits are heavily concentrated in the hands of operators who, the evidence increasingly suggests, did not build their customer bases through legitimate means.
Kenya Revenue Authority (KRA) collected Ksh 13.233 billion in excise duty from the betting sector in the 2024/2025 financial year, a figure that the government has regularly cited as evidence of the industry's contribution to the national fiscus, but that sits alongside human costs that official revenue statistics do not capture and that official communications do not emphasize.
In October 2024, Susan Njeri, a small-scale trader in Kakamega County known to her community as Mama Sammy, died by suicide after losing Ksh 60,000 on a betting platform, a sum that represented not a luxury expenditure but the economic foundation of her livelihood.
In the same year, a first-class honours graduate from Maasai Mara University lost Ksh 900,000 on a single night's betting and took his own life, a tragedy whose dimensions extend beyond the person to encompass the educational investment, the family sacrifice, and the social aspiration that a first-class degree represents in the context of Kenyan economic reality.
Research published in December 2025 confirmed what addiction counsellors working in this space have documented for years: that Kenya's gambling crisis is overwhelmingly concentrated among economically stressed young men who were lured into compulsive behaviour by platforms that knew, through the exploitation of stolen intelligence, exactly how to reach them, exactly what offer to present, and exactly when their financial circumstances made them most susceptible to the promise of a transformative win.
A 2025 study examining peri-urban men in Kajiado County found that 69% were using gambling as a maladaptive coping mechanism for economic stress, that 93.1% reported severe post-gambling guilt, and that 51.7% reported a material worsening of their mental health as a direct consequence of their gambling behaviour.
Addiction counsellor Chrispus Githae Kimaru has articulated the dynamic with precision that statistics alone cannot convey, observing that betting companies in Kenya are not selling entertainment but industrialising desperation.
The allegation that now stands before Kenya's courts and regulatory authorities is that Odibets went further than even this formulation suggests, paying for a precision map of where that desperation was concentrated most densely and approaching it with the intelligence advantage of stolen data that its targets had no idea existed.
What the Industry Now Faces ¶
The arrest of Andrew Aligula, the May 13 court ruling, and the renewed calls for investigation by law enforcement and regulatory bodies collectively represent a moment of reckoning for Kenya's betting sector, one that industry insiders, regulators, and consumer advocates are approaching from very different positions but with a shared understanding that the landscape has shifted in ways that cannot be reversed.
For Odibets specifically, the scrutiny represents the most serious institutional challenge the company has faced in its eight years of operation, a period during which it transformed from a startup into one of the dominant players in a sector characterised by fierce competition and regulatory tolerance.
The outcome of any formal investigations launched following the court ruling could have consequences that extend to licensing decisions, compliance requirements, criminal prosecutions of senior officers, and the company's ability to continue operating across the multiple African markets in which it has established a presence.
The betting sector more broadly is now watching to see whether the investigative and regulatory apparatus of the Kenyan state will treat this case as an opportunity to establish a genuine compliance threshold for data-driven customer acquisition, or whether the institutional momentum will dissipate before it reaches the outcomes that the forensic evidence appears to support.
Regulators, policymakers and consumer rights advocates have increasingly pushed for stricter enforcement of the Data Protection Act and stronger safeguards for citizens whose information is held by private companies, and the Safaricom data breach litigation has given that advocacy a body of evidence and a public profile that it previously lacked.
The Gambling Regulatory Authority of Kenya, equipped with new powers under the Gambling Control Act 2025 and having already demonstrated willingness to use those powers against operators who fail to meet licensing standards, faces a defining test of whether its regulatory mandate extends to criminal conduct through which some operators may have built the very customer bases over which it now exercises oversight.
The Reckoning ¶
Andrew Aligula is no longer untouchable.
The cold cell at Gigiri Police Station, the unanswered calls to the President, the stunning silence from political corridors that he had cultivated and financed for years, all of it marks a rupture in the operating assumptions that have governed Kenya's betting industry since its explosive growth began in the mid-2010s.
The rupture may prove temporary, the product of a specific political moment rather than a durable shift in enforcement culture, or it may prove to be the point at which Kenya genuinely began to reckon with what it permitted to happen in the years when the industry was growing fastest and the oversight was lightest.
What the May 13 ruling and the forensic evidence before the courts have established beyond reasonable dispute is that millions of Kenyans, without their knowledge or consent, had their most sensitive personal information extracted from one of the institutions they trusted most, packaged into commercial targeting intelligence, and sold to companies that used it to approach them at their most financially and psychologically vulnerable. The people who conducted that theft are subject to criminal proceedings.
The companies that allegedly purchased the intelligence are now under the attention of the courts, the regulators, and a public whose patience with the industry's self-regulatory assurances has been reduced. Whatever the final legal and regulatory outcome, the controversy has already accomplished something significant.
It has made visible, in forensic and narrative detail, the mechanisms through which Kenya's betting industry grew so rapidly, reached so deeply into the economic lives of its citizens, and built the foundations of a gambling crisis that now touches virtually every family, every neighbourhood, and every institution in the country.
The data was stolen.
The vulnerability profiles were compiled.
The targeting was precise. And the consequences, measured in lost savings, broken families, and lives ended far too early, were entirely predictable to anyone who cared to look.
In today's digital economy, customer data is among the most valuable assets any company possesses, and how that data is obtained, protected, and used will ultimately determine not only a company's reputation but also whether its executives remain free.
Kenya is now in the process of finding out whether that principle applies with equal force to the powerful as it does to everyone else.
