Safaricom, a leading telecommunications company in Kenya, has had a lot of difficulty recently. It is already under attack by the Kenya Revenue Authority (KRA), which is demanding it cough up $84.3 million in a gambling tax dispute and is now the target of another attack. A lawsuit has been launched against the company after it was determined that the privacy of its customers had been breached when the gambling data of 11.5 million Safaricom customers was possibly stolen, according to local media.
The lawsuit was submitted in Kenya’s High Court last week by Benedict Kabugi. In the suit, the plaintiff asserts, “The data, which the petitioner herein viewed personally, was specific to gamblers who had used their Safaricom mobile numbers to gamble on various betting platforms registered in Kenya.”
Kabugi says that he can prove the data was stolen. He says that he was contacted by someone on May 18 who told him that he had possession of Safaricom data for 11.5 million subscribers and showed him the evidence. The data had specific details regarding subscribers, including full names, phone numbers, identification numbers, passport numbers, total amounts gambled and more. Kabugi then contacted police but, when they were slow to respond, he went to Safaricom.
Things became really interesting when Kabugi was arrested on June 6 for reasons that aren’t totally clear. He was forced to prepare a statement on data issues—possibly to disprove or prove any involvement in the theft—and the information he provided was helpful. Two Safaricom employees were later arrested and charged with trying to extort around $3 million out of Safaricom for the data. That, says Kabugi, is enough to confirm the data breach.
If the courts see things his way, it could be a big blow to Safaricom. Kabugi explains, “I have filed this petition under article 22(1), 22(2) (b), 22 (2) (c), 258 (1) (2) of the Constitution Section 4 of the consumer protection act.” He wants the company to pay each of the affected customers—all 11.5 million—around $100,000 (10 million Kenyan shillings).
Between the $84.3 million the KRA wants and the billions at stake through the lawsuit, Safaricom has its hands full. It’s not likely that the company would be forced by a court to pay the full amount requested in the lawsuit, but some type of compensation could be ordered due to its inability to better protect user data.
