Safaricom PLC, Kenya’s largest telecommunications company and the backbone of mobile money through M-Pesa, is facing one of the most serious legal and reputational challenges in its history.
A landmark High Court case has revealed allegations that over 11.5 million subscribers’ personal data may have been exposed, accessed, and shared without consent, triggering constitutional questions about privacy, corporate accountability, and digital surveillance in Kenya.
What makes this case extraordinary is that it is not based on speculation or social media rumours. It is rooted in:
The case has now become a defining moment in Kenya’s digital rights landscape.
The petitioners in the case argue that between 2018 and 2019, Safaricom failed to protect sensitive subscriber information, leading to a large-scale internal breach involving rogue access to company systems.
According to court documents, the alleged compromised data included:
The court heard allegations that internal actors within Safaricom’s systems exploited privileged access to extract this data and share it externally.
Reports presented in court also suggest that the data may have been transferred through:
This created what petitioners describe as a systemic and prolonged breach rather than an isolated incident.
In a major ruling delivered by the High Court, Justice Bahati Mwamuye found that Safaricom violated key constitutional rights of the petitioners.
The court specifically cited violations of:
The judge ruled that Safaricom, as a data controller, had a legal obligation to safeguard subscriber information but failed to implement adequate protections.
The court ordered:
The court also emphasised that constitutional damages were justified due to the seriousness of the breach and the risk posed to millions of subscribers.
What makes this case particularly significant is its alleged scale.
Court filings and investigative reporting suggest:
Even though only 11 petitioners received compensation in the judgment, the court acknowledged that the underlying dataset could affect millions of users.
This has raised fears that:
Court documents describe a disturbing pattern of internal system misuse.
Employees with privileged system access allegedly extracted subscriber data without authorization.
The data is alleged to have been transferred to:
One of the most serious allegations is that subscriber data was shared with betting companies for commercial gain.
Named entities referenced in court materials include major betting platforms operating in Kenya.
Some of the data allegedly included betting behavior tied to M-Pesa transactions, raising concerns about financial profiling without consent.
One of the most controversial aspects of the case is the alleged involvement of betting firms.
According to court submissions:
If fully proven, this raises serious questions about:
Safaricom has strongly denied liability for the alleged systemic breach.
The company argues that:
Safaricom also challenged the credibility of some evidence presented, claiming that parts of the petition relied on disputed documents and testimony from individuals facing criminal charges.
Despite Safaricom’s defence, the court emphasised a key principle:
Once a prima facie case of systemic data breach is established, the burden shifts to the data controller to prove system integrity.
This means Safaricom was required to demonstrate the following:
The court found that this burden was not fully discharged.
This case is not just about Safaricom—it represents a turning point in Kenya’s digital rights landscape.
Kenya’s Data Protection Act is now being actively tested in court for the first time at scale.
Since Safaricom operates M-Pesa, concerns extend into:
There is growing concern that user data may be:
without clear user awareness.
This case may open the door to:
The case has triggered widespread discussion online, with many Kenyans expressing:
Social media discussions highlight a growing sentiment that large tech and telecom companies may have too much access to personal data without sufficient transparency.
The High Court is expected to continue handling related petitions and appeals.
Key possible outcomes include the following:
The Safaricom data breach case represents more than a corporate scandal—it is a defining moment for digital privacy in Kenya.
At its core, the case raises urgent questions:
As courts continue to issue rulings, one thing is clear: Kenya’s digital economy is entering a new era of accountability.
And Safaricom, the country’s most powerful telecom company, is at the center of it.
Why Regulators Penalized Banks for Allegedly Sharing Borrower Data Without Consent Co-operative Bank of Kenya…
Questions Raised After Court Backs Co-operative Bank in Suspicious Dormant Account Case The Employment and…
A storm of controversy swept across social media on Tuesday after Indian doctor, identified only…
A handwritten note, hauntingly decorated with matchsticks, has surfaced, allegedly from Asumbi Girls High School, leaving parents…
The glamorous world of Celebrity romance was thrown into turmoil this week after popular television…
The government says learners found responsible for the destruction of school property will face legal…