(NAIROBI, KENYA) – Kenya has secured a deal with a Moldovan company to permanently delete stolen personal and business data belonging to more than two million registered firms, ending an 18 month investigation into the country’s largest government data breach.
The stolen information included beneficial ownership details and identification records of prominent investors, including families linked to President William Ruto, the Kenyatta family and former prime minister Raila Odinga.
The Office of the Data Protection Commissioner enlisted the help of the European Union Commission and data authorities in Moldova to track down the firm, B2bhint, and force the deletion.
B2bhint exploited a bug in the IT system of the State owned Business Registration Service in February last year. It accessed sensitive data including residential addresses, emails, phone numbers and names of beneficial owners.
The company sold the data, over eight million items, for up to KES 24 million ($184,615) per package. Some details, such as telephone numbers, were sold for as little as $0.015 (KES 2). The stolen data was valued at KES 2.4 billion ($18.5 million).
“In the case of BRS, when we wrote to the person behind the breach, they pushed back, and one of the issues is that we didn’t have mutual legal assistance to pursue them,” outgoing Data Commissioner Immaculate Kassait said in an interview.
“So, what we did was to rely on the goodwill of the European Union and some of the data protection authorities in Moldova. That is how we got help to zero in on that particular controller and dealt with them.”
The leak gave the public a rare view into the multibillion shilling estates controlled by some of Kenya’s most prominent families.
It also exposed beneficial ownership information that is usually only available to law enforcement agencies.
The Business Daily confirmed that B2bhint permanently deleted the data after requests from both Kenyan and Moldovan authorities.
“Yes, Kenyan authorities contacted us and Moldova reached out to us about the same issue, and we responded and deleted the data,” a company spokesperson said in an emailed response.
However, individuals who bought the information before its deletion may still hold copies. The data has not resurfaced publicly, though there are fears that some purchased records may sit on dark websites.
The leaked data included 812,863 phone numbers, 832,648 email addresses, 2,091,046 physical addresses and the status of 2,093,194 firms.
Ms Kassait said the matter took over a year to resolve due to jurisdictional challenges. The relatively new regulator lacked mutual legal assistance agreements with several foreign jurisdictions, making it hard to investigate firms incorporated outside Kenya.
The breach involved approximately two million company records, including beneficial ownership information not meant for public consumption.
It revealed the business holdings of powerful figures, including President Ruto’s family members, the Kenyattas and the Odingas.
Businesses linked to Dr Ruto’s family include Weston Hotel and Koilel Farm. The First Lady, Mrs Rachel Ruto, and the President’s daughter, Ms Charlene Ruto, were listed as directors.
The Kenyatta family has interests in hospitality, dairy, real estate and investments. Muhoho Kenyatta serves as a director in several companies, including Heritage Hotels, Brookside and Emken Investments. Other key figures included businessman John Stuart Armitage and lawyer Jacob Ogechi Ombongi.
The Odinga family has interests in energy, logistics, real estate and entertainment through East Africa Spectre and Spectre International, which manufacture cooking gas cylinders. Family linked businesses include Lennox Development, Duma Investments, Newspoint, Pan African Petroleum and Be Energy.
The breach occurred weeks after the 1st December 2024 deadline for companies to disclose beneficial owners holding more than 10% stakes through secret accounts.
B2bhint denied hacking the BRS systems. It blamed weak cybersecurity standards for allowing access to sensitive information without much effort.
The company restricted access to Kenyan company information after the hack went mainstream and the data commissioner began investigations.
The incident raised concerns over the security of government held personal data and the potential exposure of business owners to identity theft, extortion and fraud.
Ms Kassait said the regulator investigated the breach and issued an enforcement notice to the BRS identifying weaknesses and requiring stronger security measures.
She said the BRS implemented the recommendations, prompting the regulator not to issue a penalty notice.
“What we did, we investigated and even gave an enforcement notice to BRS. One of the things we identified was where the gaps were in their systems and what they needed to improve. And that is what we gave to BRS,” she said. She added that her office had continued to follow up on the implementation.
Under the Data Protection Act, 2019, data controllers must notify the regulator of a breach within 72 hours where there is a real risk of harm to affected individuals. They must also inform affected individuals in writing within a reasonably practical period.
The regulator is mandated to investigate violations, issue enforcement notices and impose administrative fines.
The BRS breach is among the major incidents handled during Ms Kassait’s tenure as Kenya’s first Data Commissioner. She retires this week after completing her six year term. She will be replaced by Lydia Sitienei, who has been the head of legal at the Communications Authority of Kenya.