Absa Bank Accused of Leaking Client Records in Sh1.51 Billion Data Breach Case

Absa Bank Kenya once faced a Sh1.51 billion bill for an alleged data breach. Then the bank got that award set aside, and three years later, the case still hasn't gone to full trial.

The holdup sits on top of a structural problem in Kenyan banking: a customer who suspects a leak has almost no way to independently verify what happened, because much of the relevant technical evidence sits inside the bank where the alleged disclosure occurred. CBK guidance requires lenders to report cybersecurity incidents to the regulator within 24 hours, and the Data Protection Act requires notifying affected customers directly, but neither produces anything a customer or the public can check from outside. There's no public registry. That gap shapes how the evidence in this case can be tested.

New Mega Africa Limited, a Mombasa transport company hauling clinker to cement plants in Tororo, Uganda, sued Absa in November 2022, accusing the bank of printing its confidential financial statements and passing them to third parties without consent. Director David Abai Omusala says the fallout was fast: insurers cancelled cover, creditors moved in, and financing lines the business depended on disappeared. Those losses, in income, goodwill, and fixed assets, became the basis for the Sh1.51 billion damages claim.

Absa missed its deadline to file a defense, and the court entered judgment against it by default. When damages were formally assessed, Justice Njoki Mwangi quantified them at Sh1,512,533,679, finding the bank had breached a fiduciary and contractual duty to its client. Absa got that award set aside to force a full hearing on the merits, arguing through corporate credit manager Wycliffe Makori that no breach occurred and that he never had system access to leak anything.

Absa also went after New Mega Africa on a separate, undisputed Sh86.4 million loan default, moving to auction a company property in Kitusuru until Commercial Court Judge Josephine Mong'are blocked the sale with a temporary injunction in June 2023, pending the outcome of the main case. Three years on, neither dispute has closed. In January 2025, the court allowed a former Absa employee to testify, reopening evidence the bank had fought to keep out. Absa still denies any wrongdoing, and the loan dispute is still live.

New Mega Africa carries the burden of proving a leak it says happened. Much of the technical evidence needed to explain how the records left the bank, if they did, sits inside Absa's own systems. That imbalance, not the size of the damages, is what the trial will actually have to resolve.