Data Leak of 43 Million Safaricom Customer Records, KES 1.432 Billion Lawsuit, and Safaricom-DCI Conspiracy to Fabricate Evidence and Commit Statutory Crimes

Following a data breach of a Safaricom central development server (CDS) operated by its finance department, about 43 million customer records were leaked in what the company considers to be an act of internal fraud. Consequently, Safaricom conspired with the ODPP/DPP and the DCI (notably the Serious Crimes Unit and the Digital Forensics Lab) to use fabricated evidence, while suppressing critical evidence, to obstruct the course of justice. This has resulted in a (Kenya Shillings) KES 1.432 billion lawsuit that was filed on February 24, 2025, against Safaricom PLC, the Attorney General, and the DPP. As well, I reached out to Amazon Web Services regarding some of the exhibits, and their response allowed me to prove that DCI and ODPP presented fabricated evidence in court. The Corporate Security Division of Safaricom fabricated some of the evidence that was submitted to court. Relatedly, did the compressed parquet file opened and examined by Victor Asila Wendo show that the data of 41,415,410 Safaricom customers leaked? Should Dilip Pal resign? What was the role of Vodafone in instigating and sustaining the criminal case related to this data leak? This post covers these questions, as well as describes the crimes committed by DCI, Safaricom, and ODPP. My opinion is that Amazon.com, Incorporated, should sue Safaricom PLC and the Attorney General (of the Government of Kenya) for the illegal use of AWS resources, including AWS infrastructure resources, for commission of statutory crimes.

Should Safaricom as a publicly listed company (PLC) be described (or designated) as a criminal that has committed statutory crimes?

The loss of data custody ensuant to the data extrusion from the Big Data environment required internet access to the privileged servers, such as this CDS. The investigation conducted internally by Safaricom’s Corporate Security Division settled on the (data) leak originating in the CDS. Any granting of internet access to CDS is subject to approval by the data management committee, which included David Nyamai, Sharon Holi, and Fred Waithaka. So, was internet access granted to CDS? If no, then how was data extruded from this CDS?

From the documented testimonies available, this data extrusion was achieved through cloud storage upload(s) whereby Safaricom data were illegally exported from the CDS to Amazon Web Services (AWS) cloud where it was stored in a simple storage service (S3) bucket named safcomdata. Obviously, this required internet access to CDS.

The leaked data that was shared with Safaricom’s Data Protection Office, Integrity Team, Morten Bangsgaard, and Dilip Pal was stored in the folder/directory named phonedata in the aforementioned S3 data bucket.

Was the Leaked Data an Anonymized Aggregate Data or Unanonymized Structured Datasets?

The data leaked was unencrypted, unanonymized structured datasets that were the output of federated data that had been processed in a data pipeline. This reveals that this (leaked) data was processed by a server that had access to the MPESA server, the subscriber registration server, and the call records server. I know this because the verified documented samples of the leaked data that I have seen show unique subscriber data, along with phone type, income range, age cohort, and usage of data and voice services. “With this data it was possible to know where one lives. Given the multitude, it was considered a national security (sic)”, deponed Samuel Ochieng – a Safaricom cyber security expert – concerning the magnitude of the data leak.

The hacker(s) sent to Safaricom employees 2 snippets of the leaked data that contained 2,048,075 customer records, and this allowed Safaricom investigators to confirm that indeed the hacker(s) was in possession of authentic, yet illegally acquired Safaricom customer data. Samuel Ochieng confirmed receipt of these snippets during a meeting with Patrick Kinoti, Titus Mwenda, David Nyamai, Eric Mugo, James Yogo, Kennedy Kaberia, and Odhiambo Ooko. Samuel Ochieng stated in court that they downloaded one of the files sent by the hacker(s) for analysis.

The verified documented samples of the leaked data that I have seen show unique subscriber data, along with phone type, income range, age cohort, and usage of data and voice services.

According to the aforementioned internal Safaricom investigation report, aggregated data was found in the directory whose data was leaked (and became the subject of the investigation). Aggregated data is anonymized, and is considered to be proprietary company data that is subjected to statutory protections that are different to those accorded to personal data. So, did the hacker only leak the structured dataset and not the aggregated data? Or, was the report trying to obliquely justify a way to avoid proper acknowledgment of the data leak as per statutory laws? This questions can never be conclusively answered, but it is important I raise them here.

Unanonymized structured datasets are personal data that must be protected according to the Data Protection Act of 2019. This act also mandates the data controller – in this case, Safaricom PLC – to inform the data subjects about the fraudulent leakage of their data, in line with provisions of §43 of this act.

The data that leaked was clustered unanonymized datasets that were fit to be stored in a data lake or a data lakehouse. So, the leaked data was personal data of Safaricom customers.

Amazon Web Services

After an ad hoc meeting held to discuss the data leak, Patrick Kinoti instructed Eric Mugo to trace the source of the leak and compile a report of his findings. In his report, Eric Kabugo Mugo states that the leaked data was uploaded to an Amazon account that did not belong to Safaricom. “The Amazon was (sic) account where the (leaked) data was uploaded to was not a Safaricom amazon account but a personal account”. So, does Safaricom own AWS accounts for storing data (either in data lakes or data lakehouses)? If yes, which servers upload data to these AWS accounts? Was the CDS procedurally configured to upload data to AWS account(s)? If yes, was any data uploaded into any of these AWS accounts on the purported date of the data leak? If yes, who uploaded the data and was the upload procedural or illicit?

According to an unstamped and unsigned report of examination created by Peter Mbatha (service number 90597) for the Cybercrime Forensic Unit of the National Police Service (NPS), this exfiltrated data was hosted in an AWS account named “studyudemys”. As will be explained later, this forensic report will be contested in court as fabricated evidence that was submitted in the trial court by Peter Mbatha (attached to the Digital Forensics Lab [DFL] of the Directorate of Criminal Investigations[DCI]). This same fabricated evidence was used by Patrick Omondi (service number 93647 and then attached to Serious Crimes Unit [SCU] of DCI) to amend the charge sheet. How Eric Kabugo, David Nyamai, and Patrick Kinoti are associated with this fabricated evidence is explained later.

For now, the question that needs to be answered is whether fabricated evidence was presented in the trial court? If yes,then who submitted this fabricated evidence?

Fabricated Evidence and Evidence Tampering

Is there proof of fabricated evidence? The answer is yes. The proof is the fabricated evidence that the Digital Forensic Lab (DFL) of DCI submitted in court as exhibit C that the DCI policeman, whose service number is 90597, described as the storage drive taken from CDS (which was the server of interest in the investigation).

Relatedly, I reached out to Amazon Web Services (AWS) and provided it (AWS) with some of the exhibits (that were submitted in court), and they helped confirm that these exhibits were fabricated evidence.

According to the laws of Kenya, it is illegal for any DCI policeman (or policewoman) to fabricate evidence or willfully submit fabricated evidence in a trial court. Not only are the implicated DCI policemen/women committing criminal offenses that can be prosecuted under the Criminal Procedure Code (Cap 75) and the Penal Code (Cap 63), but they also show contempt of court and undermine Article 50 of the Constitution of Kenya of 2010 (CoK2010). This also calls into question the conduct of the prosecutor (and the ODPP) who allowed fabricated evidence to be used for malicious prosecution of the plaintiff, who has instituted this lawsuit that seeks damages amounting to KES 1,432 millions.

As is explained later, Mbatha committed perjury. Likewise, the ODPP knowingly built its case on contested fabricated evidence, and this perverts the course of justice, as well as amounts to professional misconduct and abuse of office, besides contravening Article 157 of CoK2010.

Another issue that needs to be considered is whether Patrick Omondi (No.93647 and then attached to SCU of DCI) tampered with evidence or produced fabricated evidence in court. Is the laptop that Patrick Omondi menacingly confiscated from the plaintiff the same laptop that was presented in the trial court as evidence? Accompanied with Sergeant Joseph Kipruto, Patrick Omondi menacingly, and without a court warrant, dispossessed the plaintiff of a Lenovo laptop whose serial number was duly noted in the inventory list they signed at DCI headquarters, but the laptop that Omondi submitted the next day to the digital forensic unit at DCI headquarters had a different serial number (which was duly noted by Corporal Yvonne Anyango, No.92399). The laptop that was then produced in court did not have a serial number as per the memorandum of plaint of this lawsuit.

So, were the serial number of the laptop tampered with while it was in custody (and eventually erased), or were three (3) different laptops used as evidence in this case? To make matters worse, Omondi (No.93647) could not recognize the server which was breached when asked to identify it in court and admitted that he had no knowledge of the exhibit memo confirming that the breached server was taken into DCI custody. “I do not know how the server reached the (DCI) Forensic Lab”, said Omondi (No.93647) in court. As the investigating officer, what was he really investigating if he could not identify the server that was breached?

Interestingly, Mbatha states that he investigated the server that was breached. Did he investigate the actual (physical) server or the (virtual) server image? To answer this question, one must answer an obvious question, how did Mbatha get access to this server? I am asking this question because no one states that the server was released (temporarily) by Safaricom to DCI forensic lab. It is not mandatory for the physical server – which was breached – to be taken into DCI custody for investigations to be done. The forensic image of this server can be obtained, and this server image can serve as exhibit in the investigation. However, Omondi (No.93647) stated that there was no exhibit memo showing that DCI received the server or server image for investigation!

The Corporate Security Division of Safaricom – through Eric Mugo – reported that the “aggregate” data that was leaked was initially hosted in a CDS directory in the breached server. This directory is contained in a physical server storage drive, and this storage drive can be imaged as stated above. In this forensic drive image will be the image of the directory that contained the leaked data. Omondi of DCI stated that they did not have custody of the server image. So, if DCI cannot prove custody of the server image, how did they obtain contents of the aforementioned directory? Likewise, if this directory was not imaged, then which investigation did DCI do (on this directory) and then present in court?

The number of leaked customer records is not certain because Safaricom PLC never made a timely report of this data leak to the Office of the Data Protection Commissioner (ODPC) as mandated by the Data Protection Act 2019, particularly Section 43 of this act.

Antony Kagirison

In his report, Mugo stated that he heads a team that includes 3 police officers, all with the rank of Inspector of Police, and that they have been seconded by NPS to Safaricom PLC so that they can easily aid in criminal investigations. Did Mugo image the server? If yes, it was not difficult to ask any of the police officers in his team to liaise with DCI to ensure that DCI had obtained the server image for investigation. This way, a key hardware in Safaricom’s cloud infrastructure could be offline for minimal time, while allowing for investigations into the data leak to occur.

Away from the server image for now, how did the ODPP participate in the criminal case?

Mutual Legal Assistance

Seven (7) months into the case, the ODPP – through a request made by C.M.Mwaniki – sought a mutual legal assistance from Swiss and American authorities with the goal of getting two foreign companies to aid their investigation. These companies were Proton AG and Amazon Web Services, Incorporated (AWS Inc.). About six weeks earlier, DCI had issued a consubstantial request of mutual legal assistance via the International Criminal Police Organization (INTERPOL).

Interestingly, despite Proton AG and Amazon Web Services, Incorporated (AWS) showing readiness to procedurally and legally cooperate with the investigation into this data leak, the ODPP did not pursue this path, instead choosing to rely on DCI and internal Safaricom investigations. Already, these foreign companies were cooperating to mitigate the adverse effects of the data leak.

Proton AG through Shayn had informed Annette Wanjiru (of Safaricom PLC) on the steps they had taken after receiving a report of the abuse of their email service by the hacker(s). This is despite Annette Wanjiru making a crude request to ProtonMail. “Kindly share with us any information identifying the user to aid in our investigation”, wrote Annette Wanjiru in her unprocedural request to ProtonMail, a subsidiary of Proton AG. Annette used the official Safaricom Abuse email account of [email protected] to make the aforementioned unconventional request. Basically, this amounts to abusing the official email account used to report abuses to Safaricom.

Refusal to pursue assistance from AWS left the ODPP and DCI with only the exhibits obtained from Safaricom PLC and the gadgets of the plaintiff. As is explained later, this undermined the investigations.

The question of whether DCI got the server image raises another question, what if the server in question – i.e CDS – did not exist. How do we know it existed? Before answering this question, let us consider the magnitude of the leak. How large was it?

How Large was the Data Leak: Was it 35 million Customer Records, 41 million Customer Records, or 43 Million Customer Records?

The number of leaked customer records is not certain because Safaricom PLC never made a timely report of this data leak to the Office of the Data Protection Commissioner (ODPC) as mandated by the Data Protection Act 2019, particularly Section 43 of this act. So, it is not clear if it was 35 million customer records that were leaked (as derived from the deponement of Samuel Ochieng), or was it 41 million customer records (as can be derived from the deponement of Victor Asila Wendo)? My take is that 43 million customer records leaked in this data breach, and I derive this from the investigation report written by Eric Kabugo for the Ethics and Compliance department, then headed by Patrick Kinoti (now the Group Director Non-Financial Risks in Equity Bank Limited).

I derive the 43 million value from the correspondence between the hacker(s) and Safaricom PLC, with this correspondence running into 8 emails sent by the hacker(s) with the eighth email titled “Final breach completed – let’s talk”. Interestingly, the hacker sent the eighth email 48 hours 34 minutes after he sent the first email titled “35 million customers data breach – very soon on
dark web”. The ad hoc meeting mentioned above was held on the same day that Safaricom received the first email notifying them of the breach. As mentioned, the attendants in this meeting were Kennedy Kaberia, Samuel Ochieng, Patrick Kinoti, Titus Mwenda, David Nyamai, Eric Mugo, James Yogo, and Odhiambo Ooko among others.

Relatedly, the data format is interesting because parquet format cannot directly add data into tables created by data organized in row-based file format. I will explain later why the data examined by Asila raises the question of whether the data of 41,415,410 unique Safaricom customers leaked.

As stated previously, Mugo deponed that the leaked data originated from the CDS in the Big Data environment. Now, our focus is on whether this CDS existed. To do this, we need to show that it (CDS) was set up and that it operated, as well as mention the people who set it up and used it.

Central Development Server (CDS)

How do we know that CDS was created and operated by the finance department of Safaricom PLC?

In the statement that David Nyamai Kasuki recorded at DCI headquarters, he stated that there exists a Big Data and Business Analytics department that he had led before handing it over to Charlotte Kepadisa. Also, he stated that this department reports to the Chief Financial Officer (CFO), Dilip Pal.

Nyamai affirmed that he headed this department during the purported time of the data leak, and he had a team made up of 17 scientists, with 4 of them being contractors from Vodafone Group PLC. This means that the data leak happened in his department during his leadership. This also places him as a good source of information about how the central development server (CDS) came into operation and who operated it.

Nyamai stated that his data science team needed to work with the data engineering team to optimally serve the finance department, especially following an assessment report by McKinsey Consulting that recommended scaling of the data science team. The data engineering team was then headed by Kamau Maina, and his superior was George Njuguna. The data engineering team that collaborated with the data science team was dubbed the big data engineering team, and was headed by George Kanja Matuthu. Matuthu reported to Kamau Maina.

Nyamai stated that it is the data engineering team that sets up servers that are used by the data science team, especially the big data lake servers. The data engineering team also install tools required by the data science teams in these servers. Likewise, the data engineering team maintains the big data environment and creates the data pipelines that are needed by the data science team.

According to Nyamai, his team needed a centralized data science environment that would allow on-site and remote data scientists to work together, as well as allow Safaricom and Vodafone scientists to collaborate easily on data projects. It is for this reason that the central development server was setup.

The central development server (CDS) was setup by Matthew Mutiso – a member of the data engineering team under George Matuthu. The list of data scientists that could access and use the CDS was approved by the data engineering team, with Huzair Bashir confirming this approved list. Now, we know that CDS was set up by the data engineering team for use by the data science team. The data scientists were using this CDS during the time of the data leak.

The Safaricom data science team members who had access and used the CDS before and during the period it was breached (hacked) were the plaintiff, Victor Asila, Hillary Wangila, Martin Macharia, Billy Lugado, Benson Olugo, Seaman Kinyua, Jeff Ogucha, Kevin Mbugua, Roselyn Kinuthia, Anthony Irungu, David Gitahi, and Robert Ayub Odhiambo; while the Vodafone scientists who had contemporaneous access and usage rights were Riyaj Azad Shaikh, Udbhav Pangotra, Sourav Mahajan, and Gaurav Srivastava. The line managers for this team were David Nyamai, the plaintiff, and Victor Asila.

The data science team repeatedly requested help from George Matuthu when running the CDS. Let me mention an appropriate incident here.

According to an email sent to the plaintiff, Huzaira Bashir, Shaiykh Riyaj, and Victor Asila (and copied to Matthew Mutiso), George Kanja Matuthu noted that the Central Development Server (CDS) had been granted a proxy bypass for 2 weeks, and that he had sought a permanent exception to the existing tailored access restriction. In his email message, Matuthu noted, “we had a proxy bypass to allow us to access the packages, and we were given a 2 week grace period by security team. We are seeking a permanent exception to this, to allow us to be upgrading them as time goes”. The packages Matuthu is describing are pre-written programming codes that were required by the data science team in their operations of the CDS. Huzaira Bashir had earlier warned the aforenamed (data science) team members as follows: “DO NOT try and upgrade any python or pip installation”. Now, the questions are: Was Matuthu able to get the permanent exception he had sought? If yes, would this exception modify the scope of internet restriction granted to this CDS? If there was internet connection, who was authorized to connect the CDS server to it (the internet)? Unfortunately, we cannot know the answers to these and other related questions because Matuthu was never called to testify in the case. This omission was noted in the judgment that acquitted the plaintiff in the criminal case filed by the ODPP. On October 16, 2024, Muriu Mungai & Company Advocates LLP noted that this acquittal had been subjected to an (ongoing) appeal (at Milimani High Court).

Mugo and Mulila are best positioned to answer questions about this directory, because it is this directory that is considered to be one of the primary fabricated evidence that was presented in court by the corporate security division (of Safaricom) and DCI. If Mulila claims ignorance of Mugo’s investigation report, then why did he allow the report to be issued as an authoritative internal report? Also, was this report given to DCI? Did DCI claim ownership of this report when they submitted it (or parts of it) as an exhibit in the trial court?

How I Confirmed that Fabricated Evidence was Presented in the Trial Court

During his testimony in the trial court presided over by Senior Principal Magistrate R.K. Ondieki, Mbatha stated that the leaked data had been uploaded from a Safaricom server to AWS cloud. I reached out to AWS about this, and this is how I found out that DCI presented fabricated evidence in court. I was also able to trace the origin of this evidence fabrication to Eric Mugo.

This is the AWS response to the exhibit I provided to it…

To read the full post, subscribe to our private newsletter.