Was Safaricom System Hacked Again Or An Internal Sabotage

Barely a week has passed since Safaricom system fault enabled customers to acquire data bundles free of charge. Social media postings revealed that a system malfunction at Safaricom’s headquarters on 28 June had enabled customers to acquire bundles of up to 64 GB of data free of charge.

Safaricom would immediately detect and rectified the glitch that had many ‘lucky’ customers acquire themselves the luxurious platinum package.

However, this wasn’t the first, Safaricom has in the recent past been faced with serious system glitch with the biggest being a data breach where the company has been taken to court for. Internal fraud cases is something Safaricom continues to struggle with as it keeps coming.

Safaricom has been sued for Sh115Trillion for breaching the data of 11.5 Customers. According to the petition filed in the High Court by one Benedict Kabugi, the telco breached the privacy of 11.5 million of its customers by exposing their sports betting history and biodata.

“The data, which the petitioner herein viewed personally, was specific to gamblers who had used their Safaricom mobile numbers to gamble on various betting platforms registered in Kenya,” said the petition.

In the suit, the data allegedly contained specific identifying details of subscribers, including full names, their mobile phone numbers, gender, age, identity numbers, passport numbers as well as the total amounts gambled.

In the same case, two Safaricom ICT employees Simon Billy Kinuthia and Brian Njoroge were charged in court for trying to obtain Sh300 million from the company by transferring priviledged information on a subscriber from the company’s database and sharing it with an unauthorised person.

In 2017, a man from Niger shocked the Milimani Law Courts when he confessed that he was behind the network outage that telecommunications giant Safaricom suffered on April 24.

Mohammed Sani, claimed that the recent Safaricom network outage that triggered panic across the country was planned and executed from his cell at Industrial Area Prison in Nairobi.

“I know everything that happened the day Safaricom shut down; we did it in my prison cell.

“I have all the evidence and people in prison who are willing to come out as witnesses to support my claims so that they are not seen as baseless allegations,” Sani claimed.

On 3rd Wednesday July, another disaster struck the region’s biggest teleco, this time it was on their Twitter page. Users realized unusual responses from the official account which at first was attacking government officials in the wake of the new CEO search following the death of Bob Collymore.

One of the tweets posted from Safaricom’s official Twitter page attacking government official the CS. Has since been deleted.

More attacks wedged on Itumbi who’s the Presidency’s Digital Strategist, from the Safaricom’s official Twitter account.

That wasn’t the end of it, there were some other random tweets from the account that pointed at unusual behavior and a serious problem. All these tweets have since been deleted from the account and these are screenshots we collected from affected users.

Some of the deleted posts.

Safaricom in a damage control move and probably after taking back the account, acknowledged the tweets and made a public apology.

Good morning.
We apologise for the series of tweets that went out from our official accounts last night.
We had a system glitch that has since been rectified.

Thank you.

Advertisement

— Safaricom PLC (@SafaricomPLC) July 4, 2019

System Glitch? For those of you who use Twitter know what a system glitch would do, while most corporates automates their replies, the replies from Safaricom were obviously not automated but personalized to the tweets replied to.

Because of this fact, there are several possibilities as to what exactly would’ve happened. First, the handlers of the account forgot to switch accounts, see most of these corporates have social media handlers who use bulk tweeting apps like Tweetdeck that can use multiple accounts on one app, one has to manually switch between the accounts to make post.

So in a scenario where the handler is using both their personal account and the firm’s, they can forget to switch and post wrong tweet in the wrong account. In the Safaricom’s case, we can theorize that handler A forgot to switch to switch from Safaricom’s and thought they were tweeting all along on their personal handle where the language is free.

Second scenario is the Twitter account was compromised. Kenya Insights has managed to talk to a few insiders at Safaricom and there’s rife speculation that a disgruntled ex employee who possibly had log in credentials to the official account, gained access and made the raunchy tweets. Well this we can’t independently confirm as it remains mere allegation.

Another scenario is also just a hacker doing it for fun. Unlike in many cases where anonymous hackers gain entry, there’s no group that has claimed responsibility so this is out of question leaving the above two theories the most likely but not necessarily the real reason.

Or maybe we can just speculate that someone was drunk at work. You obviously don’t expect an official admission of failure and Safaricom to take responsibility, naturally a coverup would be most ideal.

With cases of ‘technical hitches’ continuing to hit Safaricom which basically holds the economy of Kenya given its dominance not only in the money transfer, calls and data services, a lot of security questions and concerns continues to arise.

One would question how secure the Safaricom system is and the security of customers data now that there was recent data breach. One would also ask if the social media accounts can be compromised or suffer a hitch as they say what else can be compromised and the mechanisms put down by the company to avoid similar problems.

Squad Digital Media a subsidiary of ScanGroup Kenya handles the social media pages alongside Safaricom’s internal communications team. We’re informed that investigations are underway to determine the cause of last nights glitch.