Kenya’s betting industry is under intense scrutiny after the Gambling Regulatory Authority (GRA) confirmed it is investigating Odibets over allegations that it purchased stolen Safaricom subscriber data to grow its customer base.
Betika and Kwikbet have also been named in the wider investigation, which has also been highlighted by The Star.
The investigation follows a formal complaint by businessman Benedict Kabugi Ndungu, the whistleblower who first reported the Safaricom data breach to police in 2019.
In his complaint, Kabugi named Odibets, its parent company Kareco Holdings Limited, Betika, and Kwikbet as licensed betting firms that allegedly received and commercially benefited from subscriber information obtained through the breach.
According to the GRA, the investigation is based on a Directorate of Criminal Investigations (DCI) forensic report and a High Court judgment that ordered Safaricom to pay Sh9.9 million in damages over the unlawful handling of subscriber data.
For Odibets, the matter has moved beyond allegations. The company is now facing an active regulatory investigation alongside a criminal probe involving one of its senior executives.
Its licence renewal has also come under close attention as the investigations continue.
A DCI forensic report identifies Odibets as one of the alleged buyers of the Safaricom subscriber database in what investigators describe as an eleven-month criminal conspiracy.
Investigators claim the company acquired stolen data covering about 29.9 million Kenyans through several separate transactions.
Much of the forensic evidence is drawn from WhatsApp conversations exchanged between former Safaricom employees and the alleged buyers of the data.Within the evidence, investigators repeatedly refer to a contact identified as “Andrew,” who the DCI report links to a confirmed Sh1 million payment from Odibets.
One of the WhatsApp messages asks whether Odibets would pay for the data, while investigators say the payment had already been made.
The report identifies the individual as Andrew Akwesera Aligula, the chief operating officer and a major shareholder of Kareco Holdings Limited, the company behind Odibets, which is registered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi.
For years, Aligula remained largely out of public view while Jimmy Kibaki, widely reported as the son of former President Mwai Kibaki, served as chairman and became the public face of the company.
His public appearances were limited, including participation in a 2020 SiGMA World panel where he discussed the effects of the Covid-19 pandemic on the betting industry. Investigative reports and company records describe him as an influential figure within the gambling sector with strong political connections.
Odibets was among the 99 betting firms approved for licensing for the 2025/2026 financial year under the Gambling Regulatory Authority of Kenya.
That licence has now become a major issue as regulators consider the outcome of the ongoing investigations.
With Aligula out on police bond following his arrest and the company’s online platform having previously been shut down by court order, the renewal of Odibets’ licence is no longer viewed as a routine process.
The GRA must now determine the company’s future while a key executive remains under criminal investigation.
Kabugi’s complaint, addressed to DCI Director Mohamed Amin and GRA Director General Peter Maina Karimi, asks the regulator to suspend Odibets’ licence until investigations are completed.
The case also relies heavily on the High Court judgment in Constitutional Petition E095 of 2026, delivered on May 13, 2026, where Justice Bahati Mwamuye ruled that Safaricom violated the constitutional rights of its subscribers.
The court found that Safaricom employees extracted personal data belonging to 11.5 million subscribers over nearly seven years before supplying it to third-party betting firms for commercial purposes.
Eleven petitioners were awarded Sh900,000 each, bringing the total damages to Sh9.9 million, with additional costs and interest expected to increase the amount.
Paragraph 67 of the judgment states that forensic analysis of WhatsApp conversations between former Safaricom employees reinforced the finding that subscriber data had been systematically compromised.
According to the court, financial transaction records, betting history, device identifiers, and location information were repeatedly shared through WhatsApp, Google Drive, and email for commercial use.
The court further found that weak internal controls at Safaricom allowed employees broad access to subscriber databases.
Safaricom denied responsibility and argued that rogue former employees acted independently while disputing claims that millions of subscribers were affected.
However, the court rejected that argument and ruled that the available forensic evidence, including material produced by Safaricom itself, showed the breach was widespread rather than isolated.
For Odibets, the judgment extends beyond Safaricom because the court found that subscriber information was passed to named betting firms. Reporting on the case has placed Odibets within that chain of evidence as an alleged buyer identified through WhatsApp conversations involving its COO.
Kabugi’s complaint alleges that the data Odibets is accused of obtaining, including financial records, betting history, device identifiers, and location information, helped the company improve customer acquisition and increase sales through targeted marketing aimed at existing gamblers.
He has urged the GRA and the DCI to treat the alleged conduct as unlawful acquisition and use of personal data that justifies immediate licence suspension rather than treating it only as a civil dispute involving Safaricom and its subscribers.
Odibets, Kareco Holdings Limited, and the other companies named in the wider forensic investigation did not respond to media questions about their appearance in the DCI report, the allegations that they bought stolen Safaricom subscriber data, or their data handling practices.
Even as regulatory action has intensified, that position has remained unchanged, with the matter now progressing into a full GRA investigation where licence suspension remains a possibility.
Odibets is not the only company named in Kabugi’s complaint.
Betika, whose co-founders George Mburu and Chris Mwirigi are separately linked to the same forensic WhatsApp evidence, together with Kwikbet, which is also linked to Mburu, appear in the same DCI forensic record.
Industry observers say the developments involving Odibets provide an indication of the possible regulatory and criminal consequences under Kenya’s data protection and gambling laws.
Those developments include the arrest of its COO, a court-ordered shutdown of its platform, and a licence renewal now being considered alongside an active criminal investigation.
Kabugi’s complaint urges the GRA to apply the same level of scrutiny to all the betting firms named in the investigation.
The GRA has informed Kabugi that investigations into the betting companies named in his complaint remain ongoing and that he will receive formal communication once they are concluded.
Aligula remains out on police bond as investigators continue building their case around WhatsApp evidence linking him to the alleged Sh1 million payment.
At the same time, Odibets’ licence renewal remains before the regulator, which is under growing public pressure to demonstrate that confirmed forensic links to stolen subscriber data carry meaningful legal consequences.
The High Court’s Sh9.9 million judgment against Safaricom now provides a legal foundation that the GRA, the DCI, and any future civil claims involving Odibets may rely on as the investigations continue.
Leave feedback about this