In a dramatic twist that could shake Kenya’s largest telecom giant to its core, a city businessman has accused Safaricom of orchestrating a cover-up and turning against him after he blew the whistle on a massive data breach that exposed personal information of more than 11.5 million subscribers.
Benedict Kabugi Ndung’u, once hailed as an insider informant helping the company uncover a data theft ring, now says he was betrayed, branded a criminal, and slapped with trumped-up charges — all to silence him and protect powerful interests within the telco.
According to explosive court filings, Kabugi alleges that Safaricom fabricated claims that he attempted to sell leaked subscriber information to betting giant SportPesa, branding him as a rogue whistleblower who tried to extort the company for hundreds of millions.
But Kabugi insists he was acting under the direct instruction and supervision of Safaricom’s own Ethics and Compliance boss, Patrick Kinoti M’Arithi, and with the full knowledge of senior executive Sitoyo Lopokoiyit.
Kabugi paints a picture straight out of a corporate thriller — secret meetings, money transfers, encrypted links, and betrayal from within.
He claims Kinoti personally sent him Sh50,000 via M-Pesa on May 25, 2019, to facilitate a “sting operation” meant to track down individuals behind the massive data leak.
The operation was meant to lure the culprits identified as Charles Njuguna Kimani and Mark Billy Nderitu, both allegedly Safaricom insiders into believing they were about to sell the stolen data to a top SportPesa manager.
According to Kabugi, he kept Safaricom in the loop at every step.
“Kinoti told me to keep the deal warm,” Kabugi says in his affidavit, adding that all his actions were sanctioned by the company’s own agents. He now accuses Safaricom of deliberately twisting the narrative to portray him as a villain after he exposed just how deep the rot went.
He says the telco’s narrative that he only turned into a whistleblower after failing to sell the data is a desperate attempt to flip the script and protect senior managers implicated in the breach.
Kabugi insists he never demanded Sh100 million from Safaricom to reveal the identity of the hackers, as the company claims.
Instead, he says Safaricom offered him Sh3 million to “avoid embarrassment” and quietly settle the case once it became clear that the breach was real and traceable to its own staff.
Things took a darker turn when Safaricom, realizing the gravity of the breach, lodged a complaint with the Directorate of Criminal Investigations (DCI). Kabugi alongside two Safaricom managers, Simon Billy Kinuthia and Brian Wamatu Njoroge was arrested and charged in what he now calls a “corporate frame-up.”
The charges, which accused him of attempting to extort Sh300 million, were, according to Kabugi, “a smokescreen to protect those really responsible for the illegal data access.”
Kabugi denies ever receiving the alleged Google Drive link that contained the stolen subscriber information.
He maintains that the only sample data he ever saw came directly from Mark Billy Nderitu and Charles Njuguna Kimani, who introduced themselves to him as Safaricom employees involved in internal operations.
He also says he does not even own a laptop contradicting Safaricom’s claim that he downloaded data onto his personal device.
According to Safaricom’s own statement, the DCI eventually seized the laptop believed to contain the stolen data and stored it securely.
But Kabugi suggests that this “laptop” may have been a convenient scapegoat, used to close the investigation without exposing the true masterminds within the company.
As the court battle heats up, the case has peeled back the glossy corporate image of Kenya’s most profitable firm, revealing a murky world of data leaks, shadowy internal deals, and whistleblowers-turned-scapegoats.
Kabugi now wants justice and vindication.
He has sued Safaricom for breach of data and defamation, claiming that the company not only failed to protect its customers but also destroyed his life for daring to expose the truth.
“This is not just about me,” Kabugi says. “It’s about millions of Kenyans whose personal data is being traded like currency while those responsible sit comfortably at the top.”
If his claims hold up in court, Safaricom could be staring at one of the most explosive corporate scandals in its history one that exposes not just a data breach, but a betrayal from within.
There's no story that cannot be told. We cover the stories that others don't want to be told, we bring you all the news you need. If you have tips, exposes or any story you need to be told bluntly and all queries write to us [email protected] also find us on Telegram
