Naivas, owned by Kenya’s Mukuha family, faces penalty for data breach violation

Naivas International, the leading Kenyan retailer founded by the late businessman Peter Mukuha Kago, may be hit with a Ksh5 million ($34,000) sanction following its failure to promptly report a major data breach.

The breach, which exposed the personal information of countless customers, has raised concerns about the company’s adherence to data protection regulations.

According to a Senate committee hearing held on Tuesday, Naivas failed to comply with the law when reporting a ransomware attack that occurred in April of this year. The attack resulted in the unauthorized transfer of 611 gigabytes of personal data from the customer loyalty program, including sensitive information such as names, phone numbers, email addresses, and loyalty points.

Data Protection Commissioner Immaculate Kassait, speaking at the parliamentary buildings in Nairobi, revealed that Naivas did not report the breach within the required 72-hour window, as mandated by Section 43 of the Data Protection Act, 2019, and Regulation 38 (1) of the Data Protection (General) Regulations 2021. Furthermore, the company could not definitively determine the extent of the unauthorized data transfer, compounding its breach of the law.

Naivas, a retail giant established in 1990 by the late Kenyan tycoon Peter Mukuha Kago, has long held a dominant presence in Kenya, boasting an extensive retail network nationwide. Earlier this year, the company announced ambitious plans to open two additional branches in Kenya, to solidify its position as the country’s largest retail player.

This expansion initiative coincides with news that Mambo Retail, an investment vehicle linked to IBL Group, a prominent Mauritius conglomerate led by Mauritian tycoon Arnaud Lagesse, intends to acquire an additional 11-percent stake in Naivas.

To facilitate this acquisition, IBL Group will subscribe for additional shares in Mambo Retail, thereby securing a controlling 51-percent stake in Naivas. This strategic move positions IBL Group as the leading shareholder.

The Mukuha family, heirs of the late Kenyan retail tycoon Peter Mukuha Kago, stands to gain $41.7 million from the sale of the additional 11-percent stake in Naivas International. The decision to sell this stake is primarily driven by a pursuit of profitability and market share growth.