Safaricom Reports 1.25 Billion Cyber Intrusion Attempts: What It Means for M-PESA Users and Their Money

Safaricom has revealed that it detected and monitored approximately 1.25 billion cyber intrusion attempts during the 2025/2026 financial year, highlighting the growing cybersecurity challenges facing Kenya’s digital economy.

The figures were disclosed by Safaricom Group Chief Executive Officer Peter Ndegwa on October 27, 2026, during the launch of the company’s 2026 Sustainable Business Report in Nairobi. The company also investigated more than 130,000 security events during the financial year. People Daily reported the disclosures.

For millions of Kenyans who depend on M-PESA to send money, pay bills, receive salaries and run businesses, the announcement raises an important question: what do these cyberattacks mean for ordinary users?

The first distinction is essential. An attempted cyber intrusion is not necessarily a successful attack. The reported figure does not mean that criminals accessed 1.25 billion customer accounts or stole money on that scale. It reflects the volume of attempted intrusions detected and monitored by the telecommunications company.

Nevertheless, the figures illustrate why digital security matters to anyone using mobile money or storing personal information online.

What Are Cyber Intrusion Attempts?

A cyber intrusion attempt occurs when someone or something tries to gain unauthorised access to a computer system, network, account or digital service.

These attempts can take different forms. Criminals may use malicious software, exploit weaknesses in computer systems, bombard services with traffic to disrupt them, or impersonate legitimate organisations to trick customers into revealing confidential information.

In mobile money services such as M-PESA, not every threat involves directly hacking Safaricom’s systems. Some criminals target customers instead, exploiting fear, trust or a lack of awareness to convince them to reveal information or approve transactions.

The Communications Authority of Kenya has previously identified threats such as phishing, voice phishing, ransomware and distributed denial-of-service attacks in its national cybersecurity reporting. These threats can affect businesses, institutions and individuals in different ways.

What Does This Mean for M-PESA Users?

For an ordinary M-PESA customer, one of the most relevant risks is fraud involving personal information and mobile phone numbers.

 1. Fraudsters may impersonate Safaricom

A criminal may call or message a customer claiming that their M-PESA account has a problem, that a transaction requires verification, or that their phone number is about to be disconnected.

The caller may sound convincing and create urgency to pressure the victim into sharing confidential information or following instructions that expose their account.

Customers should never disclose their M-PESA PIN, one-time passwords or other confidential security credentials to callers or people claiming to be customer care agents.

 2. SIM-swap fraud can put accounts at risk

SIM-swap fraud occurs when a criminal fraudulently obtains control of another person’s mobile number, potentially allowing them to receive calls and messages intended for the legitimate owner.

This can create serious risks for services linked to the number, including mobile money and accounts that rely on SMS verification.

Business Daily reported on October 27 that Safaricom was strengthening SIM-swap safeguards after Kenya experienced significant losses associated with mobile-number hijacking. Customers should contact Safaricom immediately if their SIM suddenly loses network service unexpectedly and they suspect unauthorised replacement.

 3. Fake messages and links can expose personal data

Fraudsters may send links claiming that a customer has won money, qualifies for a loan, needs to update account information or must reverse a transaction.

Such links can lead to fake websites designed to collect passwords, identification details and financial information.

Customers should avoid clicking suspicious links and instead use official Safaricom channels to verify messages and account issues.

 4. Unauthorised transactions may still occur

Strong security systems reduce risk, but no digital service can be assumed to be completely immune to fraud.

Customers should review transaction notifications, keep confirmation messages and report suspicious activity immediately. If money disappears without authorisation, they should contact Safaricom through its official customer-care channels and follow the instructions provided.

 How Cyberattacks Can Affect Businesses

The consequences extend beyond individual M-PESA users. Thousands of Kenyan businesses depend on digital payments to receive money from customers, pay suppliers and manage daily operations.

A successful cyberattack could disrupt payment systems, expose customer information, interfere with business operations or cause financial losses.

For a small shop, restaurant or online seller, even a temporary inability to receive payments can affect sales and customer confidence. A business that loses access to customer records may also face additional costs investigating the incident, notifying affected parties and restoring systems.

Businesses using M-PESA Buy Goods, PayBill numbers or online payment integrations should therefore maintain secure access controls, restrict account privileges to authorised employees and verify payment notifications before releasing goods or services.

They should also avoid sharing administrator passwords, regularly review transactions and maintain secure backups of essential business information.

Importantly, a business should not rely solely on screenshots supplied by customers as proof of payment. It should verify transactions through its authorised payment records.

What Happens to Personal Data During a Cyberattack?

Personal data includes information such as names, telephone numbers, identification details, email addresses, account information and transaction records.

If attackers gain unauthorised access to a database, they may attempt to steal, sell or misuse such information. Even when criminals do not directly steal money, exposed personal data can support future fraud and identity-related scams.

For example, a fraudster who knows a person’s name, phone number and recent transaction details may be better positioned to impersonate a legitimate service provider.

However, the 1.25 billion intrusion-attempt figure does not establish that Safaricom suffered a customer-data breach of that scale. The distinction between attempted intrusions, investigated security incidents and confirmed successful breaches is important when interpreting cybersecurity statistics.

Kenya’s Data Protection Act establishes obligations concerning the processing and protection of personal information. Customers who suspect that their personal data has been misused can seek guidance from the Office of the Data Protection Commissioner.

 Safaricom’s Response to the Threats

According to the reported disclosures, Safaricom is using artificial intelligence to identify suspicious activity and help prevent fraud. Ndegwa said the company could predict and prevent more than 94% of fraud attempts before they occurred.

The company also reported investigating more than 130,000 security events during FY2026. These figures point to the scale of monitoring required to protect a telecommunications network and the financial services operating through it.

However, such statistics should not be interpreted as a guarantee that every fraud attempt will be stopped. Security technologies must work alongside system updates, staff training, careful handling of personal information and customer awareness.

Cybersecurity is a shared responsibility: service providers must protect their systems, while customers and businesses should adopt practices that reduce their exposure to scams.

Practical Steps Every M-PESA User Should Take

Kenyans can reduce their exposure to mobile-money fraud by following several precautions:

– Never share an M-PESA PIN or confidential verification code with anyone.
– Verify suspicious calls and messages through official Safaricom channels.
– Avoid opening unknown links or installing applications from untrusted sources.
– Keep the phone and its applications updated, and use a secure screen lock.
– Check transaction messages and account activity regularly.
– Contact Safaricom immediately if a SIM unexpectedly stops working or an unauthorised transaction occurs.
– Never approve a transaction simply because a caller claims it is necessary to secure an account.
– Use strong, unique passwords for email and other accounts linked to financial services.

 The Bigger Picture

Safaricom’s report highlights the security pressures facing a digital economy where mobile money and online services have become part of everyday life.

The reported 1.25 billion intrusion attempts are not proof that customers’ money or personal data has been compromised on that scale. Instead, they demonstrate the volume of threats that digital service providers must identify, investigate and manage.

For M-PESA users, the practical lesson is to remain alert without panicking. Strong security measures by service providers matter, but so do careful decisions by customers.

As more Kenyans depend on digital payments for personal and business transactions, trust will increasingly depend on whether technology providers can protect information, respond to threats and communicate clearly when incidents occur.