On May 13, 2026, Justice Bahati Mwamuye of the High Court of Kenya delivered a judgment that changed everything. In paragraph 67 of HCCHRPET No. E095 of 2026, the Court examined forensic WhatsApp communications that Safaricom itself had introduced into evidence. Those communications, spanning June 2018 to May 2019, name the recipients of stolen subscriber data in explicit, unambiguous terms. The Court found, and stated in its judgment, that the data was disseminated to entities and individuals identified as Andrew, Odibet, the Mburus, Betika, Charles, and the Mule. These are not aliases. These are the men who today run two of Kenya’s most profitable betting companies, and the company that shares their ownership network.
This is the story of how Chris Mwirigi, George Mburu and Jimmy Kibaki, through their companies Betika and Odibets, allegedly purchased stolen private intelligence on millions of ordinary Kenyans, and used it to build betting empires that now claim sponsorship deals worth hundreds of millions of shillings, government licences, and the aura of legitimate Kenyan business success.
“The communications reveal what, prima facie, appears to be a deliberate enterprise involving the extraction, transfer, dissemination, and monetisation of subscriber data to various actors operating within the betting and gambling ecosystem.” — Justice Bahati Mwamuye, Paragraph 68
THE DATA THAT WAS SOLD AND WHAT IT CONTAINED
Before naming the men, it is necessary to understand what was sold to them, because the nature of the stolen data is what makes this scandal different from every other corporate data breach Kenya has ever seen.
Simon Billy Kinuthia, then Senior Manager, Networks and M-Pesa Systems Auditor at Safaricom, wrote an algorithm. He designed it from inside Safaricom’s most sensitive systems, using the access his employer trusted him with, to collate and package the private information of every Safaricom subscriber who had ever placed a bet. The resulting dataset did not merely contain phone numbers. It contained the full legal names, national identity card numbers, passport numbers, military identity card numbers, alien card numbers, and dates of birth of 11.5 million Kenyans. It contained their complete gambling transaction histories, the exact amounts they staked, how many times they deposited, the date they last bet. It recorded which specific betting platforms each person used. It captured their M-Pesa financial records. It logged their handset make, model and IMEI number. It tracked whether they used a dual-SIM device. It mapped their precise geographic location, down to area, region and country.
This data was then moved from Safaricom’s secured servers onto a Google Drive controlled by Kinuthia, and from there to personal laptops. The DCI and Safaricom have, to this day, been unable to recover two of those laptops. Two computers containing the intimate financial and personal details of 11.5 million Kenyans remain in circulation in the digital underground, seven years after the theft.
The commercial rationale for buying this dataset was precise and cold. Knowing which Kenyans gamble, how frequently they lose, how much they stake, where they live, and what their M-Pesa patterns look like is the single most valuable competitive asset any betting company in Africa could possess. It enables targeting that no advertising campaign can replicate. It identifies the highest-volume gamblers and their patterns. It predicts churn. It enables behavioural profiling of the most financially vulnerable people in the country. That is what Betika and Odibets are alleged, on the basis of forensic evidence produced in court, to have paid for.
CHRIS MWIRIGI AND GEORGE MBURU: THE BETIKA MACHINE
Chris Mwirigi Kaumbuthu Founder, Director and Principal Shareholder | Shop and Deliver Limited (Betika)
George Mburu Co-Founder and Director | Roamtech Solutions Limited (Betika Shareholder)
Betika was not built overnight. The company operates through a deliberately layered corporate structure designed to obscure direct ownership liability. The licensed entity is Shop and Deliver Limited, registered in Kenya under company number CPR/2010/37880, with its registered office at Beverly Court, Lenana Road, Nairobi. Chris Mwirigi Kaumbuthu is its director and principal shareholder. The registered office of Betika’s operations is at Mayfair Business Centre, Parklands Road, Nairobi.
Roamtech Solutions Limited, founded in 2011, is both a shareholder and a director of Shop and Deliver. George Mburu is the co-founder of Roamtech and has served as its Business Process Automation lead since February 2012. Mburu’s professional history runs through the technology and telecommunications infrastructure sector: he served as Senior Network Engineer at Essar Telecom Kenya, which traded as YU, and before that as Head of Networks and Infrastructure at Cellulant Group. Mwirigi similarly built his career in telecommunications technology, serving as Head of Technology at Mtech Communications Kenya and Product Development Engineer at Cellulant. Both men knew precisely what Safaricom’s subscriber database contained. Their entire professional formation was in building and operating systems of exactly that type.
Betika launched commercially in 2016, two years before the data extraction scheme began. By 2019, it held third position in Kenya’s betting market by revenue, behind only SportPesa and Betin. When both SportPesa and Betin were shut down by BCLB in July 2019, precisely the period when the Safaricom data heist was being prosecuted and investigated, Betika was handed the market on a plate. Its website traffic exploded from 4.7 million users in June 2019 to 18 million users by August 2019, a jump of over 300 percent in under three months. It became, overnight, Kenya’s largest betting platform by users. It has never looked back.
The reference to ‘the Mburus’ in the forensic WhatsApp record is not incidental. George Mburu co-founded Roamtech, which is a shareholder and director of Shop and Deliver, which owns Betika. The court record has placed his name, and his company’s, inside the criminal data transaction chain.
The forensic WhatsApp evidence before the court refers to the Mburus as data recipients. The plural form is significant and has not been explained publicly. George Mburu co-founded Roamtech, which holds a shareholder and director position in Shop and Deliver, which owns Betika. A reference to ‘the Mburus’ in a record of stolen data transactions involving Betika is not coincidental. It is an allegation, embedded in forensic evidence that a High Court judge has found credible and materially corroborated, that the acquisition of stolen subscriber data was not the act of a rogue marketing officer but a decision taken at or near the ownership level of the company.
Betika has never publicly addressed the allegations. It has continued, throughout the seven years this scandal has been litigated, to sign sponsorship deals, expand into Tanzania, Ghana, Nigeria and Malawi, and present itself as a model Kenyan business success story. It signed a KShs 231 million three-year deal to sponsor AFC Leopards. It previously sponsored the Football Kenya Federation Premier League. It ran a Safaricom-facilitated zero-rated data product called Bila Bundles, allowing Betika users to access the platform free of data charges. The relationship between Betika and Safaricom, the very company whose subscribers’ data Betika is alleged to have purchased, is a commercial partnership that was active while the criminal and civil proceedings were ongoing.
In October 2025, the Office of the Data Protection Commissioner fined Betika KShs 250,000 for demanding excessive financial data from a subscriber who sought to close his account, specifically requiring three months of M-Pesa statements as a condition of account deletion. The ODPC found this to be a disproportionate and unjustified invasion of financial privacy. It was not Betika’s first encounter with a data protection finding. It will not be its last. A company that allegedly built its subscriber base using stolen M-Pesa and betting pattern data from 11.5 million Kenyans, and that was then fined for demanding M-Pesa statements from a single customer trying to leave, is a company whose relationship with personal data is a pattern, not a series of isolated incidents.
JIMMY KIBAKI AND ODIBETS: THE PRESIDENT’S SON AND THE STOLEN INTELLIGENCE
Jimmy Kibaki Chairman and CEO | Kareco Holdings Limited (Odibets)
Andrew Aligula Shadow Owner / Director | Kareco Holdings Limited (Odibets)
Odibets is owned and operated by Kareco Holdings Limited, registered at Plot 209/2167, Crescent Lane, Parklands, Nairobi. Jimmy Kibaki, son of the late President Mwai Kibaki, who governed Kenya from 2002 to 2013, serves as chairman and public face of the company. Andrew Aligula has been identified in corporate and investigative records as a shadow owner. The company has expanded to Ghana, Zambia and Zimbabwe and claims a user base exceeding ten million across East Africa. It holds a licence under the newly constituted Gambling Regulatory Authority of Kenya and was among the 99 firms approved for licensing by the BCLB for the 2025 to 2026 financial year.
Odibets launched in 2018. That date is not incidental. June 2018 is when the forensic record of data extraction and transmission begins. The DCI forensic analysis and corroborating witness evidence establishes that subscriber datasets were being prepared and delivered to external buyers from as early as that date. One forensic message dated July 17, 2018, attributed to Safaricom employee Simon Billy Kinuthia, states explicitly that he had the full details of 29.9 million customers backed up. Odibets entered the market while that data was actively being packaged and sold.
The court record identifies Odibet as a named recipient of the stolen subscriber data in the forensic WhatsApp communications produced by Safaricom itself. The forensic report prepared by the DCI, cited in investigative reporting based on court filings, states that Odibets is among the betting firms that received and used the stolen data. The reports further detail that data was not transferred in single bulk transactions. It was sold in tailored segments: datasets of 50,000, 100,000 and 200,000 records, priced and packaged to meet the requirements of specific buyers. The commercial architecture of the sale, selling subscriber intelligence in curated batches, is consistent with a knowing transaction rather than an inadvertent receipt of compromised data.
Odibets launched in 2018, exactly when the data extraction scheme was in full operation. It then exploded from 1.9 million to 8.7 million users between June and August 2019, a 400 percent surge in two months, in the immediate aftermath of the Safaricom criminal arrests that should have destroyed the company’s advantage.
The explosion in Odibets’ market share in the second half of 2019 raises questions that the company has never answered. When SportPesa and Betin were shut down by BCLB in July 2019, Odibets grew from 1.9 million website users in June 2019 to 8.7 million by August 2019, a rise of over 400 percent in eight weeks. Betika’s growth was enormous, but Odibets’ growth was proportionally even more aggressive for a company of its size. A company that allegedly held a comprehensive intelligence database of Kenya’s 11.5 million regular bettors, their identities, their financial profiles, their locations and their betting histories, would be positioned to execute that kind of targeted acquisition with a precision that no organic marketing campaign could explain.
Jimmy Kibaki has never been questioned publicly about the allegations. He has never issued a statement addressing the forensic evidence naming his company. Kareco Holdings has not responded to investigative inquiries. The company has continued to operate under full regulatory approval, sign sponsorship deals, and run marketing campaigns positioning Odibets as a socially responsible corporate citizen through its Odi Mtaani community programme. The son of a president who built a reputation for institutional probity now chairs a company that a DCI forensic report and corroborating court evidence links to the purchase of stolen data extracted from 11.5 million ordinary Kenyans.
KWIKBET: THE THIRD COMPANY IN THE CRIMINAL CHAIN
Kwikbet, which operates under the registered entity Interactive Gaming Limited in Kenya, has maintained a deliberately low public profile throughout the data scandal. It is also named in the DCI forensic analysis as a recipient of the stolen Safaricom subscriber data. Its connection to the Betika ownership network through George Mburu intensifies the significance of its appearance in the same forensic transaction record. The question of whether the data acquisition by Kwikbet was independent of, or coordinated with, the acquisitions by Betika and Odibets, has never been formally answered.
Kwikbet was among the winners of the 2019 betting industry collapse, growing from 15,000 website users in June 2019 to 85,000 by August 2019, a rise of over 500 percent. Like Betika and Odibets, it was among the companies positioned with market intelligence that the companies that shut down did not possess. Like Betika and Odibets, it has never publicly addressed the forensic allegations against it.
WHAT HAPPENED TO SPORTPESA, AND WHY THAT MATTERS
To understand the full dimension of what Betika and Odibets allegedly did, it is essential to understand what SportPesa did not do. The origin story of the Safaricom data heist begins with Ronald Karauri, then CEO of Pevans East Africa, the company that operated SportPesa. When Simon Billy Kinuthia and his network approached SportPesa executives to sell the stolen subscriber dataset, Karauri reported the approach to Safaricom rather than completing the transaction. That act of refusal triggered Safaricom’s complaint to the DCI, which in turn led to the arrests of Kinuthia, Brian Wamatu Njoroge, and the subsequent criminal prosecution.
SportPesa is not in the DCI forensic analysis as a purchaser of stolen data. The companies that are in that record are Betika, Odibets and Kwikbet. SportPesa, whatever its other regulatory difficulties and the prolonged KRA tax dispute that cost it its licence, did not buy what the others allegedly did. SportPesa’s executives looked at a dataset of 11.5 million stolen subscriber records and walked away. The founders of Betika, Odibets and Kwikbet allegedly did not.
SportPesa’s CEO reported the approach to Safaricom rather than buying the stolen data. That act triggered the DCI arrests. The companies that did not walk away were Betika, Odibets and Kwikbet. Three companies. Three founders. No charges.
SportPesa collapsed. It lost its licence, shut its Kenyan operations in October 2019, terminated 600 employees, and spent years in regulatory and judicial limbo before a contested return. Meanwhile, Betika became Kenya’s largest betting platform, Odibets grew 400 percent in eight weeks, and Kwikbet quintupled its user base. The market that SportPesa vacated was absorbed, in significant part, by three companies that now face credible forensic evidence of having bought the intelligence that allowed them to target the same 11.5 million subscribers SportPesa refused to exploit.
THE REGULATORY AND CRIMINAL EXPOSURE NOW FACING THESE MEN
Justice Mwamuye’s judgment is not the end of this story. It is the beginning of accountability. The High Court’s constitutional findings in HCCHRPET No. E095 of 2026 establish, on a balance of probabilities applicable in constitutional adjudication, that subscriber data was extracted from Safaricom’s systems and disseminated to named external actors in the betting and gambling ecosystem. The forensic WhatsApp evidence naming Betika, Odibet and the Mburus was introduced by Safaricom itself and has been found by a High Court judge to be credible and materially corroborated.
The Gambling Regulatory Authority of Kenya, which superseded the BCLB under the Gambling Control Act of 2025, holds statutory power to investigate licensed operators, impose fines, suspend licences and initiate revocation proceedings. The GRA has already demonstrated institutional appetite for enforcement: it shut down more than fifty unlicensed betting firms in early 2025 and imposed strict advertising prohibitions. A finding that licensed operators knowingly purchased stolen citizen data is a category of misconduct entirely different from any advertising violation or tax dispute. It is a criminal predicate act. It is a basis for licence revocation. It is a basis for prosecution of controlling officers.
The Office of the Data Protection Commissioner has independent statutory authority under the Data Protection Act 2019 to investigate, audit and sanction data controllers and processors found to have breached data protection obligations. A company that knowingly acquired stolen subscriber data is not merely in breach of commercial ethics. It is, on the face of the forensic evidence before the court, a data processor that received and used personal data without the consent or knowledge of the data subjects, in violation of the Act’s most fundamental provisions. The Commissioner’s office sanctioned SportPesa in March 2025 for a data breach. The same office sanctioned Betika in October 2025 for excessive data demands. The quantum of those sanctions bears no relationship to what a finding of knowing receipt of stolen data from 11.5 million Kenyans would require.
The criminal cases against Kinuthia and Njoroge, Criminal Cases No. 962 and 979 of 2019, remain pending at Milimani Chief Magistrate’s Court after seven years. If those proceedings result in conviction, the prosecution of the buyers of the stolen data becomes a natural next step. The DCI forensic analysis that names Odibets, Betika and Kwikbet as recipients of the stolen data is not a media allegation. It is an investigative agency’s documented finding. The question of why no controlling officer of any of those three companies has been summoned to account for that finding is one that the Director of Public Prosecutions will need to answer.
A RECKONING SEVEN YEARS IN THE MAKING
Chris Mwirigi has built a legitimate public persona. He sponsors football clubs, expands into new African markets, and presents Betika as a homegrown Kenyan success story. George Mburu’s Roamtech holds the institutional infrastructure that connects his name to the company. Jimmy Kibaki trades on the political capital of his father’s legacy and the goodwill that name generates in Kenya’s business establishment. Andrew Aligula operates, as shadow owners do, without public scrutiny.
None of that background, and none of those public narratives, addresses the forensic WhatsApp record produced by Safaricom itself in the course of constitutional litigation, which a High Court judge reviewed and found to constitute credible evidence of a coordinated and organised pattern of external transmission and commercial exploitation of confidential subscriber information. The court did not speculate about what Betika and Odibet received. The court found, based on documentary evidence emanating from the respondent’s own record, that the data transmissions were real, sustained, commercially motivated and directed at specific named entities.
Eleven petitioners were awarded KShs 900,000 each. They are eleven of eleven and a half million. HCCPET No. 247 of 2019, the separate constitutional petition filed on behalf of the full class of 11.5 million affected subscribers, remains pending. The men named in the forensic record have licences. They have lawyers. They have sponsorship deals and African expansion plans and community programmes named after the streets they helped to surveil.
What they do not have, as of May 13, 2026, is the cover of silence. The judgment has broken it. The names are now part of the constitutional record of Kenya. The Gambling Regulatory Authority must act. The DPP must act. The Data Protection Commissioner must act. And the 11.5 million Kenyans whose private lives were packaged, sold and used to target them with gambling promotions they never consented to provide the intelligence for deserve to know whether the men who allegedly bought that intelligence will ever face justice.
There's no story that cannot be told. We cover the stories that others don't want to be told, we bring you all the news you need. If you have tips, exposes or any story you need to be told bluntly and all queries write to us [email protected] also find us on Telegram
