The Gambling Regulatory Authority (GRA) and the Directorate of Criminal Investigations (DCI) are currently conducting a full-scale investigation into major licensed betting operators in Kenya specifically Betika, Odibets, and Kwikbet following claims that these companies unlawfully acquired, profited from, and leveraged stolen subscriber data harvested through a massive telecommunications data breach.
The regulator’s active involvement marks a critical turning point in an expanding legal and regulatory scandal that ties corporate bookmakers directly to illegal data trafficking, behavioral profiling of gamblers, and ongoing criminal proceedings.
In an official email sent to complainant Benedict Kabugi Ndungu, who lodged a formal petition with regulatory and law enforcement bodies, the Gambling Regulatory Authority confirmed that formal investigations into the accused licensees are underway.
“Kindly be informed that the Authority is still actively handling the matter. We are conducting investigations into the allegations raised against the licensees to establish the facts and determine the appropriate action,” the Authority stated in its communication to Kabugi.
The regulator further assured the complainant of its commitment to seeing the inquiry through, adding, “We appreciate your patience and assure you that you will be informed of the outcome once the investigations are concluded.”
This confirmation provides the first official public indication that the regulator is actively examining the conduct of the betting firms following the formal complaint submitted by Kabugi on May 19, 2026. Addressed directly to DCI Director Mohamed Amin and GRA Director General Peter Maina Karimi, the complaint asked both agencies to investigate Betika, Odibets, and Kwikbet over the alleged unlawful acquisition and commercial use of sensitive subscriber data.
Beyond requesting a comprehensive criminal and regulatory inquiry, Kabugi explicitly sought the immediate suspension of the operating licences of the involved betting firms pending the final outcome of the investigations, rather than allowing them to continue operating or undergoing routine administrative renewals.
According to the complaint, the subscriber information was systematically harvested by former employees of a major telecommunications company, Safaricom, and subsequently transferred to the betting firms in explicit violation of national data protection laws.
Kabugi alleged that the companies illegally obtained this compromised information which had been illegally accessed and shared by former telco employees for financial gain to sharply enhance their customer acquisition strategies, boost sales, and drive up corporate profits through aggressive, targeted marketing directed at individuals known to engage in gambling.
The complaint further relies on findings contained in DCI forensic investigations, which indicated that the data breach was not an isolated or accidental event, but rather a sustained, criminal conspiracy that occurred over an extended period and involved massive volumes of sensitive subscriber records.
Kabugi questioned why no regulatory actions or sanctions had previously been taken against the betting firms that allegedly received and commercially exploited the data, despite ongoing civil and criminal court proceedings against the former telecommunications employees accused of executing the breach.
In establishing the legal foundation for his petition, Kabugi highlighted the High Court judgment in Constitutional Petition E095 of 2026, delivered on May 13, 2026.
In that landmark ruling, Justice Bahati Mwamuye concluded that there had been “a sustained and systematic compromise of subscriber data.”
The complainant emphasized that the compromised data was systematically distributed to betting companies and other commercial third parties who used the information for behavioral profiling and targeted marketing aimed at active gamblers.
Sources familiar with the ongoing probe reveal that the DCI has formally submitted requests for extensive administrative and statutory records from the Gambling Regulatory Authority as part of the criminal inquiry.
Investigators have requested all documentation held by the regulator regarding the affected license holders dating back to 2018, including licensing files, historic public complaints, regulatory due diligence records, and mandatory statutory returns.
The regulatory probe comes in the wake of the High Court’s determination that the constitutional rights of 11 telecommunications subscribers had been infringed through the unlawful disclosure and commercial distribution of their personal data.
Justice Bahati Mwamuye awarded each of the 11 petitioners Sh900,000 in general damages, amounting to a total payout of Sh9.9 million a liability that approaches Sh11 million once fully taxed with accrued interest and legal costs.
The High Court judgment detailed how former employees unlawfully extracted and transmitted sensitive subscriber information between 2018 and 2019 to third-party entities, including betting firms, without consumer consent or legal authority.
The evidence established that the leaked records contained sensitive financial transaction histories, individual betting activity, unique device identifiers, and real-time geolocation information.
The petitioners successfully argued that the breach was made possible by severe vulnerabilities in internal corporate controls, which allowed employees virtually unrestricted access to central subscriber databases.
During the court proceedings, petitioners presented extensive forensic material and internal communications showing that subscriber data was repeatedly shared across external platforms, including WhatsApp, Google Drive, and email, for commercial exploitation.
Paragraph 67 of Justice Mwamuye’s judgment specifically noted that forensic analysis of WhatsApp exchanges between former telco employees materially reinforced the conclusion of a sustained and systemic compromise of subscriber data.
In its defense, the telecommunications company denied liability and opposed the petition, arguing that the breach resulted from independent criminal acts committed by former employees acting outside the scope of their official employment for personal enrichment.
The company further asserted that there was no conclusive proof that the specific data of the 11 petitioners had been compromised, while disputing broader claims that millions of subscribers were affected.
However, the High Court rejected these arguments, finding that the petitioners’ claims were thoroughly corroborated by independent records, forensic material, and internal documentation produced by the telco itself.
The evidentiary trail assembled by the DCI places Odibets at the center of an eleven-month criminal conspiracy, alleging that the firm purchased stolen subscriber databases covering approximately 29.9 million Kenyans across multiple financial transactions.
DCI forensic tables detail extensive WhatsApp communications between former telco staff and buyers, highlighting a contact named “Andrew,” whom investigators linked directly to a confirmed Sh1 million payment from Odibets. Messages within the forensic record explicitly discuss whether Odibets would pay for the data, with records confirming payments had already been disbursed.
That key contact was subsequently identified as Andrew Akwesera Aligula, the Chief Operating Officer and a core shareholder of Kareco Holdings Limited the entity registered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi, which operates commercially as Odibets.
While Aligula maintained a lower public profileappearing occasionally at industry events such as a 2020 SiGMA World panel Jimmy Kibaki, son of the late President Mwai Kibaki, served as the company’s chairman and public face.
Odibets’ bookmaking licence was among 99 firm approvals issued by the Betting Control and Licensing Board (BCLB) under the Gambling Regulatory Authority framework for the 2025/2026 financial year. However, with Aligula previously arrested and released on police bond, and the betting platform having already faced a court-ordered shutdown, the ongoing GRA investigation directly impacts the firm’s licensing status.
The forensic records and complaints also directly implicate Betika and Kwikbet. The DCI evidentiary trail links Betika co-founders George Mburu and Chris Mwirigi to the same forensic WhatsApp distribution network, while Kwikbet is similarly tied to Mburu within the investigator’s evidentiary files.
Despite the severity of the findings, Odibets, Kareco Holdings Limited, Betika, Kwikbet, and their associated co-defendants have maintained silence and declined to respond to formal inquiries regarding their appearance in the DCI forensic reports, the allegations of purchasing stolen subscriber data, or their current corporate data-handling practices.
As the Gambling Regulatory Authority continues its active inquiry alongside the DCI, the regulatory and legal pressure on Betika, Odibets, and Kwikbet continues to build. With law enforcement requesting records going back to 2018, key executives on police bond, and a High Court judgment establishing a clear precedent of systemic data violation, the regulator faces mounting public scrutiny to enforce strict statutory consequences, including potential licence suspensions against operators linked to the illicit data trade.
