Kenya's Office of the Data Protection Commissioner (ODPC) has reached an agreement with B2bhint, a business data firm based in Moldova, to permanently delete records it took from the state-owned Business Registration Service (BRS). The records cover more than 2 million registered Kenyan entities. Business Daily first reported the deal. According to its reporting, B2bhint exploited a flaw in the BRS IT system in February 2025. It then sold more than 8 million data points, including shareholder home addresses, email addresses, phone numbers and beneficial ownership details. Outgoing Data Commissioner Immaculate Kassait described the regulator's role in an interview. Business Daily and other outlets say B2bhint confirmed it deleted the data. Kenyan coverage calls this the largest breach of a government body in the country's history. It ends an investigation that lasted about 18 months.
What Happened
Business Daily, HapaKenya, Kenyan Business Feed and others all give the same basic sequence. In February 2025, B2bhint used what reports call a "bug" or "vulnerability" in the BRS IT system to pull registry data on significant shareholders of Kenyan companies. B2bhint then sold the data on its own website.
When the ODPC first contacted the company, it refused. Kassait told Business Daily: "when we wrote to the person behind the breach, they pushed back, and one of the issues is that we didn't have mutual legal assistance to pursue them." Without a legal assistance treaty to rely on, the ODPC asked the European Commission and Moldova's National Centre for Personal Data Protection for informal help. Kassait said: "That is how we got help to zero in on that particular controller and dealt with them."
Business Daily, The Daily Handle, Kenyan Business Feed and Money254 report that B2bhint confirmed it deleted the Kenyan data after requests from both Kenyan and Moldovan authorities. Accounts differ on how willing the company was:
- The regulator's account: Kassait says B2bhint initially refused and only complied after regulatory pressure from outside Kenya.
- B2bhint's account: HapaKenya and SaharaWire report that B2bhint denied breaking into the BRS systems deliberately or illegally. HapaKenya reports the firm's position as being that it collected data it could reach, though that passage is cut off in the published versions.
So it is still disputed whether this was an intrusion or the bulk collection of data a misconfigured system made available. The ODPC calls it a breach and a theft. B2bhint does not.
The ODPC also took action against BRS. Kenyan Business Feed, Money254 and SaharaWire report that the regulator served BRS with an enforcement notice that identified weaknesses in its information systems. BRS made the required security improvements and so avoided a penalty notice. The ODPC does not appear to have published a formal decision or enforcement document, and none is cited in coverage. The public record so far rests on Kassait's interview and B2bhint's statement to the press.
A separate incident: Mwafrikah reported on 26 October 2026 that the Communications Authority of Kenya's quarterly cybersecurity report (July to September 2026) mentions a breach in the e-government sector earlier in 2026. That report does not name the agency, the access method or whether any data was taken. Nothing in the public record links it to the BRS incident, which dates from February 2025. Defenders should treat it as a separate, unconfirmed event.
What Was Taken
All the reports agree that more than 8 million individual data points were taken. The breakdown most often cited is:
| Data type | Count |
|---|---|
| Physical addresses | 2,091,046 |
| Company status records | 2,093,194 (reported by Kenyan Business Feed and SaharaWire) |
| Email addresses | 832,648 |
| Phone numbers | 812,863 |
| Beneficial ownership details | Not quantified |
Shareholders' residential addresses and the identities of beneficial owners are the most sensitive items. The Daily Handle notes that beneficial ownership information in Kenya is usually available only to law enforcement agencies.
Pricing is reported consistently. Bulk packages sold for up to KSh 24 million (about US$184,600, according to The Daily Handle). Single phone numbers sold for as little as KSh 2 (about US$0.015). The whole catalogue was valued at about KSh 2.4 billion (about US$18.5 million). That valuation appears to come from Business Daily's reporting and is repeated by every other outlet. None of the reports explains how it was calculated.
The exposed records include companies linked to Kenya's most prominent political families. Reports differ on how directly President William Ruto is involved:
- Business Daily, SaharaWire and The Daily Handle describe the affected businesses as "associated with" or "linked to" Ruto.
- Innovation Village is more specific. It says Ruto's own name did not appear in the records, but his wife, Rachel Ruto, and his daughter, Charlene Ruto, were listed as company directors.
Coverage also names companies tied to the Kenyatta family and to relatives of former Prime Minister Raila Odinga. Kenyan Business Feed lists Weston Hotel, Koilel Farm, Heritage Hotels, Brookside, Emken Investments, Lennox Development and Spectre International among the entities named.
The deletion does not undo the exposure. Kenyan Business Feed and Money254 report that authorities have warned that anyone who bought the data before it was deleted may still have copies. Kenyan Business Feed adds that the data has not reappeared on any public platform. That is reassuring but not conclusive.
Why It Matters
Disclosure rules created a richer target. Innovation Village points out that the breach came only weeks after a 1 December 2024 deadline. By that date, Kenyan companies had to disclose anyone holding more than 10% as a hidden or beneficial owner. Requiring companies to disclose their real owners was meant to fight money laundering and corruption. In this case it brought together, in one government system, the information that criminals running fraud, extortion or targeted social engineering most want. Other countries building beneficial ownership registers face the same risk: the register becomes a valuable target as soon as it is filled.
A cross-border data broker is a gap in enforcement. Kassait's own account shows the main weakness. Kenya had no mutual legal assistance arrangement that let it act against a company in Moldova. Deletion depended on goodwill from the EU and Moldova's data protection authority, not on any power Kenya could enforce. When data is collected from a registry in Africa and sold by a broker outside the EU's direct reach, enforcement depends on diplomacy. Here it took about 18 months, and all that time the data was on sale.
"Breach" or "scraping" is a real question. B2bhint's denial matters for defenders. If the company's claim is accurate, the BRS weakness may have let anyone collect data in bulk at scale, rather than requiring a break-in. Either way, sensitive fields were reachable in bulk, and the registry owner did not stop it for long enough that a commercial catalogue could be built.
There is a long tail of fraud risk. Directors' phone numbers, emails and home addresses, combined with the companies they control, are ideal material for business email compromise and invoice fraud. They also help with impersonation of executives and with physical targeting of wealthy people. Copies held by earlier buyers remain a live risk.
The Attack Technique
No technical details have been made public. Every report repeats the same wording: B2bhint "exploited a bug" or "a vulnerability" in the BRS IT system. The ODPC's enforcement notice reportedly described "weaknesses in its information systems" but has not been published.
The following is analysis, not confirmed fact. Several details fit bulk automated collection better than a traditional intrusion: the scale (records on essentially every registered entity), the structured output (separate counts of addresses, emails, phones and company status), and B2bhint's claim that it collected accessible data. Common causes of this kind of exposure in government registries include:
- APIs or search endpoints that return full records, including personal fields, without checking whether the requester should see them
- Sequential or guessable record IDs that let someone step through every entry (a flaw known as insecure direct object reference, or IDOR)
- No rate limiting or bot detection on public search
- Back-end responses that contain more data than the web front end displays
Neither BRS nor the ODPC has confirmed which, if any, of these applied.
What Organizations Should Do
- Audit what public registry endpoints actually return. Inspect raw API responses, not just what the page shows. Remove residential addresses, personal contact details and beneficial ownership fields from any response that does not strictly need them. Disclosure laws often allow different access levels for the public and for law enforcement, so enforce those levels on the server, not in the user interface.
- Make bulk collection hard and visible. Use non-sequential record IDs, rate limits for each client and each API key, and alerts on query volumes that look like someone is listing the whole dataset. Collecting 2 million records leaves a clear traffic pattern if anyone is watching.
- Watch for your data being sold. Registry operators and large companies should regularly search data broker sites and B2B lead-generation platforms for their own datasets. A commercial catalogue on a public website should not take months to notice.
- Plan cross-border enforcement before you need it. Regulators and data controllers should map in advance which data protection authorities and legal routes they can use in the countries where brokers commonly operate. Kenya's success came from informal goodwill, and that cannot be relied on.
- Treat exposed contact data as permanently compromised. Kenyan companies whose directors or beneficial owners appear in BRS records should expect targeted phishing, fake requests to change payment details, and impersonation of executives. Strengthen callback checks for any request involving payments or bank details. Brief named executives and their families on the risk to their personal security.
- Meet the notification deadline. Under Kenya's Data Protection Act 2019, data controllers must notify the ODPC within 72 hours of becoming aware of a breach. Rehearse detection and escalation so that clock can actually be met.
Sources: Moldovan Firm Deletes Stolen Data of Over Two Million Kenyan Compan... | Moldovan firm erases leaked Odingas, Kenyattas’ dealings - Business... | Moldova’s B2bhint erases leaked business data on prominent Kenyan p... | How a Foreign Firm Stole Data of Kenyan Businesses and Sold Phone N... | Kenya got a Moldovan Firm to delete data stolen from Two Million Bu... | Ruto, Kenyatta, Odinga Data Erased After Breach – The Daily Handle | Kenya brokers deal to delete leaked data of prominent investors — S... | Kenya Cyber Breach: Government Incident Confirmed