Report Reveals How Betika’s Empire Was Allegedly Built On Stolen Data

In 2019, Betika became Kenya’s biggest betting company. Its two main rivals, SportPesa and Betin, had been swept off the market by a government licence crackdown, their directors deported, their bank accounts frozen.

Betika, then third in the market, was the last major local operator standing.

Within months its user base exploded from 4.7 million to 18 million.

It planted its flag across nine African countries. Its founders became celebrated as architects of a Kenyan technology success story. It sponsored football clubs, marathons, a Mount Everest expedition, and the national rugby team.

What was never celebrated, and what is now contained in a Directorate of Criminal Investigations forensic report before the High Court, is the foundation beneath that success. According to that official forensic analysis, Betika was not merely a beneficiary of its rivals’ misfortune.

It was a repeat buyer of stolen personal data covering millions of Kenyans, data extracted from Safaricom’s servers over an eleven-month criminal conspiracy.

The forensic evidence places the co-founders of Betika, George Mburu and Chris Mwirigi, directly in the WhatsApp conversations through which the stolen data was negotiated and transacted.

On May 13, a High Court in Nairobi will deliver its judgment in a constitutional petition arising from the same theft.

Whatever the court decides about Safaricom’s liability, the forensic record implicating Betika does not expire with any particular ruling.

It sits in the court file. It was compiled by the state’s own criminal investigators. It names individuals. And it is now inseparable from the larger story of how Kenya’s dominant betting platform was built.

Betika was not just a purchaser of stolen data. It was the most frequent buyer. And the WhatsApp evidence in the DCI forensic record places co-founders Mburu and Mwirigi personally inside those transactions.

SHOP AND DELIVER: THE COMPANY AND THE MEN BEHIND IT

Betika is the trading name of Shop and Deliver Limited, a company registered on December 21, 2010, with company number CPR/2010/37880 and registered offices at Beverly Court, Lenana Road, Nairobi.

Its operational headquarters sit at Mayfair Business Centre, Parklands Road, Nairobi.

The company holds a BCLB licence under the Betting, Lotteries and Gaming Act, Cap 131, and was among the 99 firms approved for licensing by the regulator for the 2025/2026 financial year under the new Gambling Regulatory Authority of Kenya.

The corporate architecture of Shop and Deliver Limited resolves clearly through company registry records and professional profiles verified by Kenya Insights.

Chris Mwirigi Kaumbuthu is listed as a director and the controlling shareholder, the only individual owner of shares in the company.

Roamtech Solutions Limited, a mobile technology company, is simultaneously a shareholder and a director of Shop and Deliver. Roamtech Solutions Limited was co-founded by George Mburu, who is described on his professional profile as a technopreneur and co-founder of Roamtech Solutions Limited and Betika.com.

Both Mwirigi and Mburu therefore hold direct and traceable interests in the corporate entity that operates Betika.

Mwirigi’s professional trajectory before Betika included stints as Product Development Engineer at Cellulant, Head of Technology at Mtech Communications Kenya, and Web Application Developer at Yellow Pages Kenya.

Mburu worked at Cellulant Group Limited as Head of Networks and Infrastructure before joining Essar Telecom Kenya as Senior Network Engineer.

Both men are technologists by training and entrepreneurs by design.

Their creation of Betika in 2016 was built on a foundation of deep technical knowledge of Kenya’s mobile telecommunications and digital payment ecosystem, the very ecosystem through which Safaricom’s subscriber data was the most commercially valuable intelligence that could be acquired.

The current CEO of Betika is Robinson Mutua Mutava, appointed in July 2024. Mutava joined the company as head of finance when Betika launched in 2016, was promoted to Deputy Managing Director in January 2023, and became Managing Director in 2024 before assuming the Group CEO title.

His elevation underlines the continuity of Betika’s leadership structure, which has operated within a tight circle of founders and early executives since the company’s inception.

THE DCI FORENSIC REPORT: BETIKA WAS THE MOST FREQUENT BUYER

Between June 2018 and May 2019, former Safaricom employees Simon Billy Kinuthia, then a senior manager responsible for networks and M-Pesa audit systems, and Brian Wamatu Njoroge, then head of regional expansion, ran a criminal enterprise that extracted subscriber data from Safaricom’s servers and sold it to betting companies.

The Directorate of Criminal Investigations conducted a forensic analysis of WhatsApp conversations recovered from the devices of Kinuthia and Wamatu.

That analysis was compiled into an official forensic report that forms part of the evidentiary record in proceedings currently before the High Court.

That report names Betika as a recipient of stolen subscriber data.

It does not describe a single transaction.

It describes multiple separate purchases across the eleven-month period of the theft. Betika, according to the forensic analysis, was the most frequent buyer in the scheme.

The data was distributed in commercially segmented tranches, with subsets of 50,000, 100,000, and 200,000 subscriber records packaged and priced individually. Sample datasets were provided in advance to establish the data’s authenticity. Full databases were transmitted on confirmation of payment.

Betika returned to this market repeatedly.

The WhatsApp forensic evidence contains the name of George Mburu in the context of these transactions. Chris Mwirigi also appears in the chat records. The forensic record therefore does not merely point to the corporate entity trading as Betika.

It points, through the recovered conversations of the criminal conspirators, to the men who founded and controlled the company.

The implications of this are direct and severe: if the evidence is accepted by the court as admissible and credible, the potential criminal liability extends beyond the corporation to the individuals named in those conversations.

What was being sold, and what Betika was buying, requires precise description. The stolen Safaricom records contained not names and phone numbers in isolation.

They contained the complete betting histories of 11.5 million identified gamblers, the exact amounts each subscriber had wagered over time, their M-Pesa transaction records, their handset identification numbers, their precise geolocation data down to county and locality level, their national identity card numbers, passport numbers, and in many cases their military identification numbers.

This was not general consumer data.

It was a forensic map of which Kenyans gambled, how much they lost, where they lived, and how financially vulnerable they were.

For a betting company, it was operational gold.

The DCI forensic record describes a company that came back to buy stolen subscriber intelligence again and again. Betika was not seduced into a one-time lapse. It was a systematic, repeat purchaser of stolen citizen data.

THE CRACKDOWN THAT MADE BETIKA: A TIMELINE THAT DEMANDS SCRUTINY

The sequence of events between 2018 and 2019 is critical to understanding what is at stake. The Safaricom data theft commenced in June 2018.

Betika was acquiring stolen subscriber data throughout that period. In July 2019, the BCLB suspended the licences of 27 betting firms, including SportPesa and Betin, citing alleged non-compliance with withholding tax obligations.

The government froze bank accounts and shut down M-Pesa paybill numbers.

Betika survived the cull with its licence intact.

The consequences were immediate and dramatic. In June 2019, Betika had 4.7 million users. By August 2019, two months after the crackdown, that number had risen to 18 million, an increase of more than three hundred percent.

The company became Kenya’s largest betting firm, a position it has defended ever since.

SportPesa’s exit rendered the company the default platform for millions of Kenyans who had been betting on the dominant market leader.

Betin’s closure further consolidated Betika’s position.

The question that the forensic record now forces into the open is whether Betika entered the period of its explosive growth equipped with the stolen behavioural and financial profiles of millions of Kenyans who had previously been betting on SportPesa, Betin, and other now-suspended platforms.

The stolen Safaricom database included the complete gambling histories of 11.5 million subscribers, a dataset that mapped the entire landscape of Kenya’s active betting population.

A company that had purchased multiple tranches of that data before the 2019 crackdown possessed an intelligence advantage over every competitor that could not be replicated through legitimate marketing.

The BCLB, in deciding which companies retained their licences through the crackdown, was not informed that Betika had been identified by the DCI as a purchaser of stolen subscriber data.

The DCI’s forensic report existed.

The criminal investigation was ongoing.

The licence renewal process proceeded without any of that information being transmitted to the regulator. Seven years later, the Gambling Regulatory Authority of Kenya, which inherited the BCLB’s regulatory function, remains unaware of the forensic record unless it has acted independently to obtain it.

ETHIOPIA: SUSPENDED FOR HIDING SH83.5 BILLION IN REVENUE

The DCI forensic record is not Betika’s only active regulatory crisis.

In November 2025, Ethiopia’s Lottery Service suspended the licences of twenty-two sports betting companies effective November 25, 2025, following a multi-agency investigation involving the National Intelligence and Security Service, the Financial Security Service, and the Ethiopian Federal Police.

Betika, operating in Ethiopia through its local entity Addis Telco Services Share Company, was among the twenty-two firms suspended.

The Ethiopian authorities allege that the suspended firms concealed more than 100 billion birr, equivalent to approximately Sh83.5 billion, in revenue that should have been remitted to the government.

The investigation found evidence of under-reporting and diversion of funds, with authorities describing the scheme as involving complex payment chains, foreign-hosted systems, and methods designed to evade taxation.

Twenty-four individuals, including company owners and associates, were arrested in connection with the probe.

Betika posted a notice on its Ethiopian website that read: “Dear customers, we would like to inform you that your favourite betting partner, Betika, has been suspended for an indefinite period. We will soon be back with improved odds, faster service, and a more efficient operation.” The company has made no substantive public statement about the allegations themselves.

The Ethiopian Lottery Service confirmed that licences will be revoked within a specified period unless the criminal investigation produces findings that allow reinstatement.

The Ethiopian suspension draws an uncomfortable parallel with Kenya. Betika survived Kenya’s 2019 crackdown by complying with withholding tax obligations when its rivals refused, positioning itself as the responsible local operator.

The Ethiopian authorities’ allegations now suggest that in a different jurisdiction, the same company stands accused of concealing revenues on a scale that strains comprehension.

The pattern of regulatory compliance in Kenya alongside alleged regulatory evasion in Ethiopia raises questions about whether the company’s Kenyan compliance record reflects genuine corporate values or strategic calculation.

Betika survived Kenya’s 2019 crackdown by complying with tax demands its rivals rejected. In Ethiopia, it stands accused of concealing Sh83.5 billion. The contrast between those two positions is not easily explained.

A PATTERN OF DENYING WINNERS: COURTS, THE SENATE, AND FORMAL COMPLAINTS

The DCI forensic record and the Ethiopian suspension are not Betika’s only accountability problems.

The company has accumulated a substantial record of disputes with Kenyan customers over unpaid winnings, disputes that have escalated from social media complaints to court proceedings to formal Senate investigation.

In 2023, David Juma, a gambler from Nakuru County, sued Shop and Deliver Limited at the Small Claims Court after Betika refused to pay him a Sh500,000 jackpot he had won on the Sababisha eight-game promotion.

Betika insisted that one of the eight matches had not been correctly predicted.

Juma presented betting slips, transaction records, and match results demonstrating that all predictions were accurate. Nakuru Resident Magistrate Edward Oboge ruled in Juma’s favour, finding that he had proved his case on the balance of probabilities.

The court ordered Betika to pay the full Sh500,000, costs of the litigation, and interest from the date the winnings fell due.

Betika appealed.

A High Court judge dismissed the appeal, finding it lacked sufficient merit to overturn the original ruling.

In a separate case, a woman identified as Clair Nyabayo accumulated winnings amounting to Sh99.9 million on a Betika platform. She withdrew Sh140,000 before her account was frozen.

Betika attributed her winnings to the exploitation of a system error and declined further payout.

The matter was referred to the BCLB, which applied the company’s own terms and conditions capping winnings at Sh1 million, awarding that amount while voiding the excess.

The regulatory ruling effectively protected the company from liability for ninety-nine times the amount it had acknowledged she won.

In early 2024, the Kenya Consumer Rights Alliance formally petitioned the BCLB demanding an urgent investigation into what it described as disturbing patterns of conduct by Betika, including the systematic freezing of accounts immediately after customers won substantial sums.

Sworn affidavits submitted to the regulator by at least forty-seven complainants from Nairobi, Kisumu, Nakuru, and Mombasa described strikingly similar experiences: accounts flagged without explanation, customer service non-responsive, winnings never paid.

The hashtag #BetikaPayUs trended on X as screenshots of frozen accounts and unanswered communications flooded Kenyan social media.

Senator Cherargei of Nandi raised the matter formally before the Senate’s Standing Committee on Labour and Social Welfare, demanding regulatory explanation for Betika’s refusal to honour payouts, particularly on larger amounts, and calling for investigations into underage gambling practices and consumer protection failures.

Among the cases cited was that of Collins Kiptoo, a Nandi Hills resident who alleged that Sh1.2 million of a Sh1.5 million win vanished from his Betika Aviator account after he withdrew Sh300,000, with the company claiming he had placed auto-bets he insists he did not authorise.

Betika has consistently maintained that its platform records are accurate and that customer funds are handled in accordance with its terms and conditions. It has not provided a comprehensive public accounting of the complaints.

The data protection dimension of Betika’s customer relations practices has also produced litigation.

In one case, a customer named Bosco Otieno attempted to close his Betika account.

The company told him it could only do so after he provided a copy of his national identity card and three months of M-Pesa statements, documentation that had not been required when he opened the account.

He went to court arguing that this demand was an unlawful intrusion under the Data Protection Act, 2019.

The case raised the question of whether a betting company that had itself purchased stolen subscriber financial data was now demanding additional financial history from a customer seeking to disengage from its platform.

THE LEGAL EXPOSURE: CRIMINAL LIABILITY, CIVIL CLAIMS, AND REGULATORY JEOPARDY

The legal exposure now facing Betika, Shop and Deliver Limited, and its founding officers is of a nature and scale that has no precedent in Kenyan corporate history.

The DCI forensic report documenting multiple purchases of stolen subscriber data creates potential criminal liability under the Computer Misuse and Cybercrimes Act, which criminalises the receipt and commercial use of data obtained through unauthorised computer access, with penalties including prison terms of up to twenty years.

It also creates potential criminal liability under the Data Protection Act, 2019, which provides for prosecution of directors and company officers who have committed wilful violations, with the possibility of imprisonment.

The Data Protection Act further provides for administrative fines of up to Sh5 million per violation or one percent of annual turnover for the preceding financial year, whichever is lower.

For a company of Betika’s scale, operating in nine African countries with Kenya as its primary revenue base and declaring multi-billion-shilling revenues, one percent of annual turnover represents a significantly larger penalty than the Sh5 million ceiling.

The Office of the Data Protection Commissioner has demonstrated a clear appetite for enforcement, having imposed the maximum administrative penalty in its first significant enforcement action and having consistently issued enforcement notices against corporate violators since 2022.

The Gambling Regulatory Authority of Kenya holds independent statutory power to investigate licensed operators, impose fines, suspend licences, and initiate revocation proceedings.

The GRA’s predecessor body survived a 2019 crackdown that ended the operations of Kenya’s two largest betting companies and deported foreign directors.

A finding that Betika, the company that emerged as the dominant beneficiary of that crackdown, had been purchasing stolen subscriber data throughout the period of the crackdown and during the period of its explosive growth, would create a regulatory and political emergency of an entirely different character.

The civil liability framework is equally severe.

The constitutional petition before the High Court seeks Sh1.5 million per affected subscriber from Safaricom for 11.5 million people.

If the court validates the forensic evidence of data purchases by Betika, the legal architecture for equivalent civil claims against the company by the same subscribers becomes immediately available.

Beyond the 11.5 million gambling subscribers, the DCI forensic record documents that the full Safaricom database of 29.9 million subscribers was accessed.

At Sh1.5 million per affected individual, even a fraction of that cohort mounting civil proceedings against Betika would produce figures that would threaten the company’s solvency.

The Ethiopian suspension adds a further dimension.

The allegations of revenue concealment involving Sh83.5 billion, if substantiated by the investigation, would expose the company’s Kenyan affiliates to scrutiny by the Kenya Revenue Authority and the Financial Reporting Centre.

The methods allegedly used in Ethiopia, described by authorities as involving complex payment chains, foreign-hosted systems, and hawala-type transfers designed to obscure the flow of funds, are precisely the patterns that trigger anti-money laundering investigation protocols.

If Kenyan investigators follow the Ethiopian findings through to their logical conclusion, the questions they would need to ask about Betika’s Kenya operations are not comfortable ones.

Add together the DCI forensic record, the Ethiopian suspension, the Senate probe, the court-ordered payout defaults, and the data protection litigation. What emerges is not a company that has had bad luck with compliance.

It is a company with a compliance culture built on impunity.

KENYA’S MARKET LEADER: BUILT ON WHAT, EXACTLY?

Betika’s path to market dominance is now inseparable from the questions raised by the forensic record.

The company launched in 2016.

The Safaricom data theft began in June 2018, precisely at the moment Betika was attempting to claw market share from the dominant SportPesa and Betin platforms.

The stolen database contained the complete betting histories, financial profiles, and geolocation data of 11.5 million Kenyans, almost all of whom were active customers of those dominant competitors.

A company that purchased multiple tranches of that intelligence across an eleven-month period possessed, for the first time, a precise map of every significant competitor’s customer base.

Then, in July 2019, those competitors had their licences revoked. Betika survived. Its user base tripled in two months.

It became Kenya’s largest betting company.

The company’s Wikipedia entry notes, without apparent irony, that in 2019 Betika became Kenya’s market leader in the gaming industry.

What it does not note is that in 2019 the DCI was conducting a criminal investigation that would produce a forensic report naming Betika as a serial buyer of stolen citizen data.

This is not an argument that the licence crackdown was orchestrated to benefit Betika. The crackdown had multiple causes, including genuine tax compliance disputes and legitimate government concern about the social consequences of unregulated gambling.

But it is an observation that the company that emerged from the crackdown as market leader had been, throughout the period leading to that crackdown, systematically acquiring intelligence on every other company’s customers through a criminal scheme.

The competitive advantage that delivered was not accidental.

It was purchased.

Betika has built a powerful public brand around Kenyan entrepreneurship, community investment, and responsible gambling.

It has sponsored AFC Leopards, Police FC, and Sofapaka FC.

It backed James Kagambi’s Mount Everest summit in 2021, generating significant goodwill. It launched the largest jackpot in Kenyan betting history at Sh200 million in 2022.

It claims millions of active users across nine African countries and has invested in technology infrastructure that led to it becoming the first Kenyan betting firm to list its app on the Google Play Store in 2023.

This is a company that understands marketing and brand management at a sophisticated level.

The DCI forensic report suggests that the same company understood something else at an equally sophisticated level: how to use stolen citizen data to identify and target the most financially vulnerable people in the country, how to do it repeatedly across eleven months without triggering regulatory response, and how to build a multi-billion-shilling operation on the proceeds of that intelligence while presenting, in public, the image of a responsible Kenyan success story.

SEVEN YEARS OF INSTITUTIONAL SILENCE: WHO KNEW WHAT, AND WHEN

The DCI forensic report naming Betika as a serial purchaser of stolen data was compiled during a criminal investigation that commenced in 2019.

The former Safaricom employees at the centre of the scheme, Simon Billy Kinuthia and Brian Wamatu Njoroge, have been facing criminal charges for seven years.

The forensic evidence establishing who bought the data has been in the possession of law enforcement throughout that period.

Seven years later, no criminal charges have been brought against Shop and Deliver Limited, George Mburu, or Chris Mwirigi in connection with the purchase of stolen subscriber data.

The Office of the Data Protection Commissioner has not opened a formal investigation into Betika’s data handling arising from the theft.

The BCLB, and its successor the GRA, has not initiated licence proceedings against the company based on the forensic evidence.

The KRA has not launched a separate investigation into how stolen subscriber financial data may have been used to enhance revenue collection from targeted gamblers.

The Senate probe was concerned with unpaid winnings.

The regulatory investigations have focused on advertising standards and responsible gambling messaging.

The Ethiopian authorities have acted on revenue concealment.

No Kenyan authority has yet formally addressed the core finding of the DCI’s own forensic report: that the company now operating as Kenya’s dominant betting platform purchased stolen private data from millions of Kenyans, did so repeatedly, and used that intelligence to build the commercial advantage that made it the market leader.

On May 13, the High Court will deliver its judgment.

If the court accepts the evidentiary foundation of the petition, including the forensic identification of Betika as a repeat buyer of stolen data, the pressure on the GRA, the ODPC, and the DCI to explain their institutional silence will become impossible to ignore.

The regulator that licences Betika, the data protection commissioner that is supposed to enforce the Act against commercial misuse of stolen data, and the criminal investigation directorate that compiled the very report documenting the offence will all face the same question: why has nothing been done?

THE RECKONING BETIKA CANNOT ESCAPE

Betika is Kenya’s biggest betting company.

It processes billions of shillings in bets every year.

It employs hundreds of people across nine countries. It is a source of tax revenue for the Kenyan government and several other African governments.

It has genuine community investment programmes that have produced real benefits for grassroots sport.

None of this is in dispute.

What is also not in dispute, because it is contained in an official DCI forensic report, is that Betika purchased stolen personal data from millions of Kenyans multiple times, that its co-founders are named in the WhatsApp evidence documenting those transactions, that the company built its path to market leadership during the same period in which it was operating as a repeat buyer of stolen citizen intelligence, and that it has never been publicly called to account for any of it.

The gambling addiction crisis tearing through Kenyan society, documented in parliamentary submissions, academic research, and the inquest records of young people who have died, was not caused by Betika alone.

But a company that knew, through stolen data, which Kenyans were the most financially exposed, the most compulsively addicted, and the most geographically accessible, and that used that intelligence to target those people with precision, bears a specific accountability that goes beyond the general moral criticism levelled at the betting industry as a whole.

The May 13 judgment will not determine Betika’s fate directly.

But it will determine whether the court accepts the evidentiary architecture on which a reckoning with Betika is built.

For the forty-seven complainants whose sworn affidavits describe frozen accounts and unpaid winnings.

For the thousands of Betika users who have taken to social media with the hashtag BetikaPayUs. For the millions of Kenyans whose most private financial and behavioural data was bought and sold without their knowledge.

And for the investigators, regulators, and prosecutors who have held the forensic evidence for seven years without acting on it.

Shop and Deliver Limited, George Mburu, and Chris Mwirigi did not respond to questions submitted by Kenya Insights regarding their appearance in the DCI forensic report, the allegation that Betika purchased stolen Safaricom subscriber data on multiple occasions, the Ethiopian suspension, or the pattern of unpaid winning disputes. No response was received by the time of publication.

---

Kenya Insights allows guest blogging, if you want to be published on Kenya’s most authoritative and accurate blog, have an expose, news TIPS, story angles, human interest stories, drop us an email on [email protected] or via Telegram

---