A massive storm is brewing around Kenya’s biggest telecommunications company, Safaricom PLC, as it faces accusations of betrayal, cover-up, and corporate deceit in what could be the country’s largest ever data breach scandal.
The telco, long regarded as a symbol of innovation and trust, is now under intense scrutiny for allegedly turning against a whistleblower who helped expose the leakage of private data belonging to 11.5 million subscribers.
At the centre of the saga is Nairobi businessman Benedict Kabugi Ndungu, who says he is being falsely accused and criminalised by Safaricom after he helped the company uncover a data breach that he insists was orchestrated by insiders.
According to court papers, Kabugi discovered that millions of Safaricom subscribers’ details were circulating in the black market, including names, ID numbers, phone numbers, gender, device details, and even sensitive gambling records. Shocked by the scale of the leak, he reported the matter to Safaricom, only to find himself branded as the villain in a plot he claims was masterminded by corrupt officials within the company.
Kabugi has filed a lawsuit accusing Safaricom of maliciously framing him as a data thief in a bid to hide its own internal failures.
He says that far from being a fraudster, he was in fact a whistleblower who worked closely with Safaricom’s Head of Ethics and Compliance, Patrick Kinoti M’Arithi, to trace the individuals behind the data leak.
According to him, it was Kinoti himself who instructed him to engage with two men who had access to the stolen data and even sent him Sh50,000 through M-Pesa to facilitate meetings. Kabugi insists that all his actions were carried out with Safaricom’s full knowledge and approval.
The businessman says that after receiving the money, he met with two individuals identified as Charles Njuguna Kimani and Mark Billy Nderitu, who claimed to be Safaricom employees.
His task, he says, was to “keep the deal warm” as per Kinoti’s instructions, while Safaricom’s internal team prepared a sting operation.
However, what followed shocked him. Instead of being thanked for his cooperation, Safaricom accused him of attempting to sell the stolen data to betting giant SportPesa.
Kabugi maintains that the allegation was completely fabricated to destroy his credibility and silence him before he could expose the real culprits.
He further reveals that the company’s senior executives, including Sitoyo Lopokoiyit and Kinoti, were fully aware of his interactions with the suspects and that he kept them updated at every stage.
He claims that after realising that he could not be easily silenced, Safaricom offered him Sh3 million to drop a threatened lawsuit over the data breach.
He says he refused the offer, only to later be arrested alongside two Safaricom managers, Simon Billy Kinuthia and Brian Njoroge Wamatu, and charged with attempting to extort Sh300 million from the company.
He calls the charges trumped up, saying they were designed to frame him as a criminal rather than acknowledge him as a whistleblower.
Kabugi also disputes Safaricom’s claims that he received or shared any Google Drive link containing the leaked data.
He says he does not even own a laptop, as alleged by the telco, and that the sample data he viewed was handed to him directly by Nderitu in the presence of Kimani.
He insists that the company’s narrative of him being a data broker is a desperate attempt to divert public attention from its own employees’ involvement in the leak.
What makes this case particularly alarming is the scale and sensitivity of the leaked information.
The data allegedly included intimate customer details such as gambling transactions, device IMEIs, and location information, all of which point to a catastrophic failure in Safaricom’s data security systems.
Reports suggest that the breach was facilitated by insiders with high-level access, raising serious questions about how a company that handles nearly half of Kenya’s mobile traffic could fail to protect its users.
Safaricom has repeatedly denied wrongdoing and maintains that it has “robust systems” to protect customer data. But court filings and whistleblower testimonies paint a very different picture, suggesting a company that not only mishandled a massive data breach but also punished the very person who tried to help. Critics now argue that the company’s reaction to Kabugi’s disclosures reveals a deep culture of impunity, where reputation management takes precedence over accountability and transparency.
The case has sparked outrage among data privacy advocates, who warn that if Safaricom can get away with silencing a whistleblower and covering up a breach of this magnitude, then no Kenyan’s data is safe. The Office of the Data Protection Commissioner has so far remained largely silent, fueling speculation about regulatory capture and corporate influence.
For millions of subscribers, the question now is chillingly simple: if Safaricom can lose your data and then go after the person who exposes it, what protection do you really have? As the legal battle unfolds, this case could set a landmark precedent for data protection, whistleblower rights, and corporate accountability in Kenya.
Safaricom has long been Kenya’s corporate darling, celebrated for transforming mobile money and connecting the nation. But beneath that glossy surface, the 11.5 million subscribers’ data scandal has exposed deep cracks in its moral and operational foundations. What began as an attempt to stop a data theft has spiralled into an ugly war of accusations, arrests, and reputational damage that could haunt the telco for years to come.
This is no longer just a story about a data leak. It is a story about betrayal, power, and how one of Africa’s biggest companies may have turned on the very man who tried to save it.
