29.5 Million Safaricom Customers’ Data Breach Lands Odibets Boss Andrew Aligula In Police Custody, Firm Now Operating On A Thin Line Of Court Order

For years, Andrew Akwesera Aligula ran one of Kenya’s largest betting empires from the shadows. He let Jimmy Kibaki carry the chairman title. He let the brand carry the attention. He gave his public profile to SiGMA World in 2020 as COO of Odibets, speaking on the pandemic’s impact on the gambling market with the ease of a man who felt entirely insulated from consequence. He was wrong.

On April 29, 2026, Aligula was arrested and detained overnight at Muthaiga Police Station, Nairobi. He was released the following day on police bond. He has been on that bond ever since. Kenya Insights can confirm that at the time of his arrest, the DCI did not yet have the full weight of what has since landed on their desks.

On May 19, 2026, the original whistleblower who cracked this case open in 2019, Benedict Kabugi Ndungu, filed a formal letter to the DCI Director and the GRAK Director General Peter Maina Karimi enclosing the complete DCI forensic report, the full WhatsApp evidence table, the High Court judgment of May 13, and a demand for investigation, prosecution, and licence cancellation. The police had Andrew. Now they have everything else.

When Andrew was arrested, the cops had him but not the full picture. They have it now. The forensic evidence, the court judgment, the money trail, and a formal petition naming his licence numbers are all on the DCI director’s desk.

THE INVISIBLE MAN THE DCI REPORT CALLED ANDREW

Aligula has spent his career being invisible. Company documents identify him as a core shareholder of Kareco Holdings Limited, the entity registered at Plot No. LR 209/2167, Crescent Lane, Parklands, Nairobi, that operates Odibets.

He served simultaneously as COO, the operational nerve centre of the business, the man who ran the machine while the chairman posed for photographs.

His professional profile at Califam Holdings listed him as a former Managing Director. In the Kenyan betting industry he was known, feared, and connected. He reportedly bragged openly that he was untouchable and had reach to the very top of Kenya’s political establishment.

The DCI forensic report’s WhatsApp evidence table calls him Andrew throughout. Andrew has confirmed Friday, on July 17, 2018. Ongeza Odibets ya akina Andrew, on October 11, 2018. Can you check what our friends Andrew have done in October, on October 22, 2018. And on December 5, 2018: 1M.

The annotation beside that message is unambiguous.

It confirms a Sh1 million payment from Odibets. The same day a second message asks: Odi wailsemaje, watalipa? Are they going to pay? The forensic record shows they already had. That forensic report is a court exhibit in Criminal Case No. 962 of 2019 at Milimani.

It has been cited in a High Court constitutional judgment. It is now formally before the DCI director. Andrew Aligula’s name resolves the anonymous Andrew in that record.

When Aligula was arrested on April 29, his attempts to use political connections to escape the situation collapsed. Calls to the very top went unanswered. The arrest held. What the police had in late April was sufficient to detain him. What they have now, with Kabugi’s submission of the full forensic file, is sufficient to charge him.

THE PLATFORM THAT WENT DARK: 24 HOURS THAT TOLD THE FULL STORY

Five days before Aligula’s arrest, on Friday April 24, 2026, the Odibets platform went offline.

The company’s website was pulled down. Its app stopped working. Thousands of users reported total loss of access across social media and betting forums, with punters unable to withdraw funds, place bets, or reach customer support. The outage lasted more than twenty-four hours. The cause was not a server failure. The BCLB had temporarily withdrawn Odibets’ operating licence.

Aligula and Kareco Holdings moved fast. An urgent application was filed in court seeking orders to restrain the BCLB from enforcing the licence withdrawal.

The court granted the orders. The company served the BCLB. Services were restored after more than a day offline.

Odibets is currently operating under that court order, not under a valid and uncontested licence. The company is, in the precise legal sense, being kept alive by judicial intervention while a regulatory storm gathers around it.

Those two events, the platform going dark on April 24 and Aligula’s arrest on April 29, occurred within five days of each other.

The Odibets brand has kept both facts away from its communications with its users.

Its platform continues to accept M-Pesa deposits, run jackpots, and promote free bet campaigns as though nothing has occurred. Behind that facade, its COO is on police bond and its licence rests on a court order that can be reviewed, challenged, or reversed at any point.

Odibets’ platform is alive because of a court order, not a valid licence. Its COO is on police bond. Its licence renewal is due in June. All three facts are simultaneous and none of them is survivable in isolation.

THE JUNE RENEWAL WALL: A LICENCE THAT CANNOT BE GRANTED

Betting licence renewal season in Kenya falls in June.

Every licensed operator must apply to the Gambling Regulatory Authority of Kenya (GRAK) for renewal of both its bookmaking licence and its gaming licence.

Among the mandatory requirements for licence renewal is a certificate of good conduct issued by the National Police Service, the document that confirms the applicant and its directors have no disqualifying criminal record or pending criminal matter.

Andrew Aligula is on police bond in connection with a matter directly related to the operations of Kareco Holdings Limited. He’s out on P52, and was issued one to compel attendance on 7th May.

A person on police bond pending investigation cannot obtain a clean police clearance certificate.

Without that certificate, Kareco Holdings cannot satisfy the fitness and propriety requirements for licence renewal under the Gambling Control Act 2025. Without licence renewal, the court order keeping Odibets operational becomes the only thing standing between the company and a permanent shutdown. And court orders keeping a licence alive in defiance of a regulator’s withdrawal decision are not indefinite instruments.

The GRAK has additionally received Kabugi’s formal letter requesting immediate suspension or cancellation of licence numbers BK-0001095 and PG-0001096 issued to Kareco Holdings.

That letter annexes the DCI forensic report, the High Court judgment of May 13, 2026, Safaricom’s court affidavit admitting the data has never been recovered, and a complete evidentiary record placing Odibets as a documented, paying buyer of stolen subscriber data.

The forensic data shows the purchase of 29.5 million Safaricom subscribers’ records, including the specific betting profiles of 11.5 million punters, over an eleven-month criminal scheme.

Safaricom confirmed in court that it cannot recover that data.

The data is still on Odibets’ systems.

The licence that Odibets needs in June requires clean hands. Aligula does not have them.

The company’s systems hold stolen data that constitutes a continuing criminal offence under the Data Protection Act, the Computer Misuse and Cybercrimes Act, and the Penal Code.

The forensic evidence documenting the offence has now been placed formally before the very regulator that must decide whether to grant renewal.

There is no scenario under the Gambling Control Act 2025 in which the GRAK can approve a new licence for an operator whose controlling director is on police bond for criminal offences related to those operations, whose systems retain stolen citizen data, and against whom a formal cancellation petition has been filed with full evidentiary annexures.