An investigation is underway following reports of massive data leak affecting thousands of individuals and businesses in Kenya's company registry. 

According to the Business Registration Service (BRS) Director-General Kenneth Gathuma, the organization has sought the support of cyber security experts, law enforcement and relevant investigative agencies to unravel the extent of the breach.

The BRS database has vast amounts of sensitive details on registered companies, their owners, directors, and beneficial owners among others.

“At this stage, we are still verifying the details of the alleged breach, including the nature and extent of the compromised data,” said Gathuma in statement dated 2nd February.

He added that BRS will be reacing to the affected parties once the investigations are complete. This comes even as concerns continue to pile on the possibility that massive amounts of personal data are on sale in the dark web.

“We want to assure all stakeholders that the security and integrity of the company registry remain our top priority,” he stated.

The data breach, which happened on the night of January 31, 2025, is said to have led to the exposure of national ID numbers, addresses, phone numbers, and other confidential data for thousands of people in Kenya. 

Media reports note that the data included sensitive records dating back to 1967 and has laready surfaced on dark web platforms for auction.

Whereas BRS is yet to clear the air on the data exposed, the number of affected individuals and businesses, the compromised data has the potential to trigger consequences such as identity theft, fraud, and money laundering

In 2023, industry survey shows that cybercrime cost Kenya's economy about KES10.7 billion. According to the Communications Authority of Kenya, players in the idustry reported detecting 1.1 billion cyber threats between April and June 2024.

In the three months to December 2024, Kenya detected over one billion cyber threats, a sharp increase from 123 million in the previous quarter. However, this rise was attributed to enhanced threat monitoring and the growing number of internet-connected devices in the country.

[email protected]