Safaricom-backed M-Tiba hacked, exposing affected person data

Hackers say they’ve stolen hundreds of thousands of medical and private data from M-Tiba, a Safaricom-backed digital well being pockets, in what may very well be one in every of Kenya’s largest-ever information breaches.

A bunch calling itself Kazu claims to have gained entry to greater than 17 million information, or roughly 2.15 terabytes of knowledge, from M-Tiba’s servers. The group shared a 2GB pattern of the stolen information on its Telegram channel (Kazu Breach), containing what seem like sufferers’ names, nationwide ID numbers, dates of delivery, cellphone contacts, and, in some instances, their medical diagnoses and billing data.

The leaked information embrace data on about 114,000 customers, each account holders and their beneficiaries, in accordance with information examined by TechCabal. Kazu claims as many as 4.8 million individuals may very well be affected, a determine that has not been independently verified.

M-Tiba, operated by CarePay, a Nairobi-based well being expertise firm, neither confirmed nor denied the breach. The corporate requested TechCabal to share copies of the leaked information to help with its evaluation.

“At M-TIBA, we take all issues of knowledge safety with the utmost seriousness. As a part of our normal protocol, we want to actively examine the claims you might be referring to,” stated a CarePay consultant, in an electronic mail response. “To help our inner investigation, may you please share the particular supply hyperlinks or posts which have prompted your inquiry?”

An official from the Workplace of the Information Safety Commissioner (ODPC) stated the company was conscious of the incident however declined to elaborate, citing they weren’t authorised to touch upon an lively matter.

The pattern of stolen information additionally incorporates data from about 700 well being amenities, with some scans exhibiting full billing sheets and affected person diagnostic summaries, together with the names of docs and insurance coverage firms. In a single set of paperwork, affected person IDs, contact particulars, and remedy prices have been listed alongside handwritten notes from medical workers.

If confirmed, the M-Tiba breach would mark one of the vital critical exposures of medical information since Kenya’s Information Safety Act got here into drive in 2019. The legislation classifies well being data as delicate private data, requiring strict safeguards.

Rising threats

Kenya has witnessed a sequence of breaches involving personal firms and public platforms in recent times, together with the 2023 hack on the e-Citizen platform. From schooling and tax methods to hospitals and fintech apps, the nation’s digital shift has usually outpaced its cybersecurity capability.

Cyberattacks have been rising steadily in Kenya as extra private and non-private providers transfer on-line. The Communications Authority (CA) recorded over 4.6 billion between April and June 2025, an 80% rise in comparison with the earlier quarter. Most incidents concerned phishing, ransomware, and information breaches focusing on banks, telecommunications firms, and authorities methods. 

M-Tiba has been one in every of Kenya’s digital success tales. Launched in 2016 by way of a partnership between CarePay, Safaricom, and the PharmAccess Basis, the platform permits customers to avoid wasting and spend cash particularly for healthcare. It’s additionally used to distribute insurance coverage advantages and authorities well being subsidies.

In 2024, M-Tiba claims it has over 4 million customers and partnerships with over 3,000 hospitals. Its mannequin — half cellular pockets, half medical health insurance clearinghouse — has been praised as a sensible path towards common well being protection.

That scale additionally makes it a pretty goal. If the breach is as massive as claimed, it may expose particular person sufferers and the interior information of clinics, insurers, and medical professionals.