Safaricom Wins Court Battle Over Former Executive’s Dismissal for Data Breach
The Employment and Labour Relations Court has upheld Safaricom’s decision to dismiss Brian Njoroge Wamatu, its former Head of Regional Expansion, following allegations of unauthorized access and sharing of confidential company and customer data. The court ruled that Safaricom had valid grounds and followed fair disciplinary procedures before terminating Wamatu’s employment in June 2019.
The dispute stemmed from a 2019 investigation into claims that Safaricom employees had illegally accessed, compiled, and sold subscriber data. Wamatu was arrested on June 7, 2019, after being forcibly taken from a Nairobi restaurant by unidentified men and held for interrogation before facing charges of computer fraud and conspiracy to commit a felony. He alleged his arrest was orchestrated by Safaricom to scapegoat him for data losses, a claim the company denied, stating it had merely reported suspected criminal conduct to authorities.
Safaricom’s internal investigation linked Wamatu to the unauthorized acquisition and proposed sale of confidential subscriber and corporate data, including internal security details and senior managers’ remuneration. The court accepted Safaricom’s position, ruling that the company had sufficient evidence to justify disciplinary action for breaching confidentiality obligations.
Wamatu’s claims of unfair termination, defamation, and loss of employee share benefits were dismissed. The court found that Safaricom had complied with disciplinary procedures, including issuing a show-cause letter, reviewing Wamatu’s responses, and allowing an appeal. It also rejected his argument that he was denied a fair hearing, noting he failed to attend a scheduled disciplinary session despite having time to do so after a DCI meeting.
The ruling emphasized that employment law does not require proof of misconduct beyond reasonable doubt for dismissal, provided the decision is based on a genuine belief supported by evidence. Wamatu’s defamation claim was also dismissed due to a missed filing deadline and lack of evidence proving reputational harm. The case highlights Safaricom’s efforts to address internal data breaches and enforce confidentiality policies.
Safaricom TPRM report: https://www.rankiteo.com/company/safaricom
"id": "saf1786084206",
"linkid": "safaricom",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Telecommunications',
'location': 'Kenya',
'name': 'Safaricom',
'type': 'Telecommunications Company'}],
'attack_vector': 'Insider Threat',
'data_breach': {'data_exfiltration': 'Proposed sale of data',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Confidential subscriber data',
'Internal security details',
'Senior managers’ remuneration']},
'date_detected': '2019',
'description': 'Safaricom dismissed its former Head of Regional Expansion, '
'Brian Njoroge Wamatu, following allegations of unauthorized '
'access and sharing of confidential company and customer data. '
'The Employment and Labour Relations Court upheld the '
'dismissal, ruling that Safaricom had valid grounds and '
'followed fair disciplinary procedures. Wamatu was arrested in '
'2019 on charges of computer fraud and conspiracy to commit a '
'felony after an internal investigation linked him to the '
'unauthorized acquisition and proposed sale of subscriber and '
'corporate data.',
'impact': {'data_compromised': 'Confidential subscriber data, internal '
'security details, senior managers’ '
'remuneration',
'identity_theft_risk': 'High'},
'investigation_status': 'Closed (Court ruling issued)',
'lessons_learned': 'Importance of enforcing confidentiality policies and '
'addressing insider threats through disciplinary '
'procedures and legal action.',
'motivation': 'Financial Gain (Proposed sale of data)',
'post_incident_analysis': {'corrective_actions': 'Termination of employment, '
'legal proceedings, '
'enforcement of '
'confidentiality policies',
'root_causes': 'Unauthorized access by insider, '
'lack of stringent access controls'},
'recommendations': 'Strengthen access controls, monitor employee activities, '
'and ensure compliance with data protection regulations.',
'references': [{'source': 'Employment and Labour Relations Court Ruling'}],
'regulatory_compliance': {'legal_actions': 'Computer fraud and conspiracy to '
'commit a felony charges'},
'response': {'containment_measures': 'Internal investigation, disciplinary '
'procedures',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes (DCI - Directorate of Criminal '
'Investigations)',
'remediation_measures': 'Termination of employment, legal '
'action'},
'threat_actor': 'Brian Njoroge Wamatu (Former Head of Regional Expansion)',
'title': 'Safaricom Data Breach Involving Former Executive Brian Njoroge '
'Wamatu',
'type': 'Data Breach',
'vulnerability_exploited': 'Unauthorized Access'}