The Gambling Regulatory Authority (GRA) has confirmed it is investigating several licensed betting operators following allegations that they unlawfully benefited from subscriber data obtained through a major breach.

The probe follows a formal complaint filed by a citizen, Benedict Kabugi, who accused three betting firms of acquiring subscriber information illegally accessed by former telecommunications employees. Kabugi also requested the suspension of their licenses pending investigation.

In correspondence with the complainant, the GRA stated investigations are ongoing to establish facts and determine appropriate action, assuring that outcomes will be communicated once the process concludes.

Background of the Allegations

  • The complaint, dated May 19, 2026, alleges the subscriber data was harvested by ex-telco staff and shared with betting firms for financial gain.
  • This data reportedly enabled targeted marketing strategies, boosting customer acquisition and profits for the betting companies.
  • Forensic investigations by the Directorate of Criminal Investigations (DCI) suggest the breach was sustained over an extended period, involving large volumes of subscriber information.
  • A recent High Court ruling found there was a "sustained and systematic compromise of subscriber data," supporting claims that the data was used for behavioral profiling of gambling customers.

Legal Proceedings and Court Findings

Earlier in 2026, the High Court awarded damages to 11 telco subscribers whose constitutional rights were found violated due to unlawful disclosure of personal data. The court ruled that between 2018 and 2019, former employees accessed and transmitted sensitive information—including financial transactions, betting activity, device IDs, and geolocation data—to third parties without consent.

The telco company denied liability, attributing the breach to rogue former employees acting outside their duties and disputed the scale of the compromise. However, the court found sufficient corroborating evidence from internal communications and forensic material to uphold the petitioners’ claims.

Each petitioner was awarded Sh900,000 in damages, totaling Sh9.9 million plus costs and interest.

Ongoing Investigation

The DCI has requested comprehensive records from the GRA concerning licensing, complaints, due diligence, and statutory returns related to the implicated betting firms from 2018 onwards. This inquiry aims to clarify the extent of the betting companies’ involvement in the unlawful use of subscriber data.

The GRA's probe marks a critical step in addressing data privacy concerns linked to Kenya’s betting industry amid rising scrutiny of digital consumer data protection.