Kenya has brokered a deal with a Moldovan firm for the deletion of stolen sensitive and personal information belonging to more than two million businesses registered in the country, including those associated with President William Ruto, the Kenyatta family, and several other prominent investors.
The deal puts an end to an 18-month-long probe into the largest data breach involving a government entity in Kenya’s history, securing sensitive information such as company beneficial ownership and owners’ identification details, which had been exposed.
Outgoing Data Commissioner Immaculate Kassait has revealed that her office enlisted the goodwill of the European Union Commission and the local data protection authority in Moldova to track down the company behind the breach and compel it to delete the stolen data.
B2bhint, the Moldovan company, in February last year exploited a bug in the IT system of the State-owned Business Registration Service (BRS) to access sensitive data of significant shareholders in registered firms, including residential addresses, email and phone numbers as well as names of beneficial owners.
It started selling the trove of secret data of significant shareholders, over eight million items, for as much as Sh24 million for a package and as little as $0.015 (two shillings) for telephone numbers, putting the worth of stolen data at Sh2.4 billion.
“In the case of BRS, when we wrote to the person behind the breach, they pushed back, and one of the issues is that we didn’t have mutual legal assistance to pursue them,” said Ms Kassait said in an interview.
“So, what we did was to rely on the goodwill of the European Union and some of the data protection authorities in Moldova. That is how we got help to zero in on that particular [data] controller and dealt with them.”
The far-reaching leak gave the public a rare sneak preview into the multi-billion shilling estates controlled by some of Kenya’s prominent families.
It also revealed information on beneficial owners of various companies, which has largely been the preserve of law enforcement agencies – except for investors that have done business with the government.
The Business Daily confirmed from B2bhint that it had permanently deleted the data after being requested by both Kenyan and Moldovan authorities.
“Yes, Kenyan authorities contacted us and Moldova reached out to us about the same issue, and we responded and deleted the data,” said a spokesperson for the company in an emailed response.
Those who bought the information from the B2bhint website before they were deleted may, however, still hold the data.
But the information has not resurfaced anywhere after the leak, amid fears that part of the bought data is sitting on some dark websites.
The matter took over a year to resolve due to the jurisdictional challenges that the Office of the Data Protection Commissioner (ODPC) faced, according to Ms Kassait.
Being a fairly new regulator, it lacked mutual legal assistance agreements with several foreign jurisdictions, making it hard to investigate firms incorporated outside Kenya.
The breach, which occurred in February last year, involved approximately two million company records held by the BRS, exposing personal information associated with businesses registered in Kenya, including beneficial ownership information which is not meant for public consumption.
The breach revealed the business holdings of some of the country’s most powerful figures – including President Ruto, the Kenyatta family, and several other prominent investors, including former prime minister Raila Odinga’s family.
For years, much of this information remained secret.
Although President Ruto’s name did not feature in the search, those of his family members, including his wife and two children, were prominent.
Businesses linked to Dr Ruto’s family members include familiar names such as the Weston Hotel and Koilel Farm, where Mrs Chebet Rael Kimeto (Mrs Rachel Ruto), the First Lady, and the President’s daughter, Ms Chelagat Ruto (Charlene), were listed as directors.
The data breach also revealed the vastness of the Kenyattas’ empire, spanning property, dairy processing and hotels, and of the family of Kenya’s first Vice-President, Jaramogi Oginga Odinga, which has interests in logistics, energy, real estate, and entertainment.
The Kenyatta family has interests in hospitality, dairy, real estate and investments, with Muhoho Kenyatta serving as a director in several companies, including Heritage Hotels, Brookside and Emken Investments. Other key figures were businessman John Stuart Armitage and lawyer Jacob Ogechi Ombongi.
The Odinga family has interests in energy, logistics, real estate and entertainment, notably through East Africa Spectre and Spectre International, which manufacture cooking gas cylinders. Family-linked businesses include Lennox Development, Duma Investments, Newspoint, Pan African Petroleum and Be Energy.
The breach came just weeks after the lapse of the December 1, 2024 deadline that required registered companies to disclose the names, phone numbers, and residential addresses of beneficial owners who hold more than 10 percent stakes through secret accounts to BRS.
B2bhint denied illegally hacking BRS systems to access the data, and instead blamed a weak cybersecurity standard for allowing it to access sensitive information without much effort.
It subsequently restricted access to the information on Kenyan companies after reports of the hack went mainstream and the ODPC initiated investigations into the breach.
The incident raised concerns over the security of government-held personal information and the potential exposure of business owners and company officials to identity theft, extortion, fraud and other forms of abuse.
Ms Kassait said the ODPC investigated the breach and issued an enforcement notice to BRS identifying weaknesses in its information systems and requiring the agency to strengthen its security measures.
She said BRS had subsequently implemented the recommendations, prompting the regulator not to escalate the matter to a penalty notice.
“What we did, we investigated and even gave an enforcement notice to BRS. One of the things we identified was where the gaps were in their systems and what they needed to improve. And that is what we gave to BRS,” she said. She added that the office had continued following up on the implementation of the recommendations.
Under the Data Protection Act, 2019, data controllers, such as BRS, are required to notify the ODPC of a breach within 72 hours of becoming aware of it, where there is a real risk of harm to affected data subjects. They are also required to inform the affected individuals in writing within a reasonably practical period, subject to statutory exceptions.
The ODPC is mandated to investigate data protection violations and identify their causes. It can issue enforcement notices requiring organisations to address identified shortcomings and impose administrative fines where it establishes violations of the law.
The BRS breach is among the major data protection incidents handled during Ms Kassait’s tenure as Kenya’s inaugural Data Commissioner. She retires this week after completing her six-year term and will be replaced by Lydia Sitienei, who has been the head of legal at the Communications Authority of Kenya.
