Safaricom has been sued for an eye watering Ksh. 115 trillion for an alleged data breach that involved customer data.
In a suit, filed in the High Court on Friday, Safaricom customer Benedict Kabugi accused the Kenyan telecommunication company of allegedly breaching the privacy of 11.5 Million customers. The data, according to Benedict, including his own and primary includes customers who gamble and pay using Safaricom M-Pesa. The data apparently had the following information:
- Full names of customers
- Customer number
- Gender, date of birth, and nationality of the customers
- ID numbers, passport numbers of the customers
- Total amounts spent on gambling
- The numbers of betting companies they have placed bets on, number of bets
- The make and type of device the customers use including IMEI, whether its Dual-SIM and Single SIM
- Type of network they use (2G/3G/4G)
- Location of customer
In his petition, Benedict indicated that he was approached by an individual individual who had in his possession the personal data of more than 11.5 million Safaricom customers, including his. According to the petition “The data, which the petitioner herein viewed personally, was specific to gamblers who had used their Safaricom mobile numbers to gamblers on various betting platforms registered in Kenya,” says Benedict in his petition. In the lawsuit, Benedict seeks damages of Ksh. 100 million plus an extra Ksh. 10 million each for the 11.5 million subscribers whose data was breached. The damages he is seeking translates to Ksh. 115 trillion.
This is the first time a law suit of this magnitude is being leveled against a mobile service provider in Kenya and could have far-reaching ramifications on Safaricom and its customers.
This lawsuit follows the recent prosecution of two senior Safaricom employees for allegedly stealing customer data from Safaricom servers. The two, Simon Billy Kinuthia and Brian Njoroge Wamatu, allegedly unlawfully copied and transferred privileged subscribers’ data from Safaricom’s database to a third party, Charles Njuguna Kimani. The two also faced a separate count of demanding money after they allegedly demanded Ksh. 300 million from Safaricom to return the data.
Benedict Kabugi himself was arrested and later charged over theft of the same data. This is the same data that he has instituted a lawsuit over. He was accused of unlawfully demanding the money with an intention to steal between May 1 and June 7 at Safaricom offices in Westlands, Nairobi. Benedict was granted Sh1 million bail. The case will be heard on July 6.
Find the petition here; hapakenya.com/benedict-petition