The breach, reportedly involving more than 17 million files, could be the largest cyberattack on a health platform in the country’s history.

The group behind the attack, calling itself Kazu, says it accessed approximately 2.15 terabytes of data from M-Tiba’s servers and has already leaked a 2GB sample on Telegram through its “Kazu Breach” channel. 

The shared files appear to contain sensitive details such as patients’ full names, national ID numbers, phone contacts, birth dates, and medical information, including diagnoses and billing records.

An early review of the leaked documents shows that data from about 114,000 users, both account holders and their dependents, has already been compromised. Kazu, however, claims the breach could affect as many as 4.8 million people, though this figure is still unverified.

When contacted, M-Tiba operator CarePay neither confirmed nor denied the claims but said it had begun an internal investigation.

“At M-TIBA, we take all matters of data security with the utmost seriousness. As part of our standard protocol, we would like to actively investigate the claims you are referring to,” said a CarePay representative in an email response to TechCabal. 

“To aid our internal investigation, could you please share the specific source links or posts that have prompted your inquiry?”

The leaked material also appears to include billing data from nearly 700 health facilities, with some documents displaying handwritten medical notes, doctor names, insurance details, and full payment summaries. If authenticated, the breach could expose not only individual patients but also hospitals, doctors, and insurers linked to the platform.

Officials at the Office of the Data Protection Commissioner (ODPC) confirmed awareness of the incident but declined to discuss it further, noting ongoing investigations. 

Kenya’s Data Protection Act of 2019 treats medical information as “sensitive personal data,” demanding strict storage and disclosure safeguards. 

A confirmed breach of this scale could result in legal penalties, class actions, and intense scrutiny from both regulators and international partners.

Kenya’s growing dependence on digital infrastructure has made it vulnerable to cyber threats. The Communications Authority of Kenya (CA) recorded more than 4.6 billion cyber threat events between April and June 2025, an 80% rise from the previous quarter. 

Most of these incidents targeted banks, telecoms, and government systems, primarily through phishing, ransomware, and data theft.

Launched in 2016, M-Tiba was developed through a partnership between CarePay, Safaricom, and the PharmAccess Foundation. The platform allows users to save, spend, and receive funds specifically for healthcare, and it also manages insurance payouts and government health subsidies. 

With over 4 million users and ties to 3,000 hospitals, M-Tiba has been regarded as a model for expanding affordable healthcare access in Kenya.

However, the same scale that made M-Tiba a national success story has also made it a lucrative target.

===

As Africa’s largest economy, Nigeria offers substantial growth potential across several sectors. While much of our economic potential has traditionally been based on our status as one of the world’s ten largest exporters of crude oil, the government is keen to diversify by developing other industries.

However, one major hurdle to overcome first, is financial inclusion. By the end of 2020, just 64% of Nigerians were part of the formal financial system – still short of the government’s target of 80%.

The big question remains, how do we bridge this gap? While fintech partnerships are an important route towards improving access to the digital economy, the creation of a favorable ecosystem is also a critical factor, all geared toward establishing optimal conditions for innovation and entrepreneurship.

There is a large body of published literature that offers frameworks outlining the right conditions for innovation, and this is something that Visa strives to enable through its network of global Innovation Centers, offering our partners a space to experiment and build solutions that bring more people and communities into the digital economy.

On digitalization of Nigeria’s economy, the agricultural sector is posed to reap the biggest benefits. In 2021, the sector contributed 25.9% to our real GDP and it employs more than 70% of our population – primarily at a subsistence level.

This is why the government sees the development of agriculture as an important means of employment generation, food security, and poverty reduction.

We saw this in the Agriculture Transformation Agenda 2011-2015, followed by the Agriculture Promotion Policy 2016-2020; two development frameworks that outline specific strategies – doubling the growth rate of the integrated agriculture sector to increase its contribution to the national GDP; reducing food imports to become a net exporter of key agricultural products; and integrating agricultural commodity value chains into the broader supply chains of domestic and foreign industries.

Given the importance of the agricultural sector to Nigeria, ThriveAgric, a start-up focused on digitizing the entire value chain for farmers, is a worthy regional winner of the 2022 Visa Everywhere Initiative (VEI) for the Central and Eastern Europe, Middle East, and Africa (CEMEA) region.

VEI is an innovation program that helps start-ups unlock new opportunities, giving them a global platform to demonstrate their innovation, ideas, and groundbreaking solutions.

Over the seven years since VEI’s launch, nearly 12,000 start-ups have taken part in the initiative, raising a collective $16 billion in funding.

ThriveAgric’s Agricultural Operating System helps map farmer’s lands, onboarding, recording visitations, record valuable harvest data, manage inventory, and monitor the progress of farms in real time. Over the past five years, it has disbursed financing worth more than $70 million to over 240,000 farmers, helping them double their income and triple their output.

Now, as a Visa partner, ThriveAgric will deploy Visa cards to farmers across the continent – speeding up disbursements, offering secured transactions, access to credit scoring, digitized payment flows, among other things.

Visa’s core purpose is to expand access to the digital economy – for both individuals and small- and medium-sized businesses (SMBs) – because we believe this is the key to driving both inclusive growth and prosperity for everyone, everywhere. ThriveAgric is the perfect partner for driving such growth, bringing individuals and SMBs into the digital economy while supporting the digitalization and development of one of the continent’s most important sectors.

Further development of Nigeria’s healthcare system is also critical for future growth. CarePay, a Nigerian health tech start-up, was selected as another finalist for VEI.

CarePay negotiates, aggregates, and coordinates discounts across hundreds of healthcare merchants to provide healthcare services to both insured and uninsured individuals and households.

During VEI’s CEMEA regional finals, the health tech start-up displayed how its model can drive both customer and brand retention for a range of stakeholders which includes Fintechs, card networks, banks, telcos, and pension funds and those who adopt the CarePay healthcare discount product as loyalty benefits for their customers.

The company’s drive to use digital technology to help consumers access affordable healthcare, when scaled, could result in a significant boom to Nigeria’s economy.

While ThriveAgric and CarePay have digitalized agriculture and healthcare, Lagos-founded Paga aims to boost merchant access to digital payment acceptance – which can help boost financial inclusion.

By March of 2020, when it became a Visa partner, the start-up had created a multi-channel network for more than 14 million customers in Nigeria to transfer money, pay bills, and make digital purchases through its mobile app and 24,840 agents.

Through these mini case studies, we all see why the continued development of ecosystems that foster innovation and entrepreneurship is critical.

Platforms such as VEI will continue to play a role in highlighting the best use cases of digitalization across a range of sectors, helping founders to secure valuable funding to turn their ideas into a reality while providing them access to Visa’s sizeable and global network.

With this win in the CEMEA region, ThriveAgric will receive a monetary prize and a spot in the Global Finale scheduled to be held in Qatar, in November 2022. 

Carepay, another Nigerian fintech, also made it to the final five and won the Audience Favourite Award.

More than 1,300 applicants entered the Visa Everywhere Initiative 2022 competition from across the region, each with solutions aimed at delivering innovative payment and commerce solutions to consumers and businesses. 

 “We have witnessed substantial growth in the fintech sector in Nigeria. Last year, Nigeria had the most entries from Central Europe, Middle East and Africa, this year two indigenous startups made it to the finals with ThriveAgric emerging as the winner. This is a clear demonstration of the country’s significance in the fintech sector, and the growth potential of the digital economy,” said Andrew Uaboi, Country Manager, Visa Nigeria.

Ayo Arikawe, Co-Founder, ThriveAgric, said, “Agriculture is at the centre of the Nigerian economy, yet the sector faces productivity-limiting challenges like access to finance, poor access to the market, and technical know-how. This is why our goal at ThriveAgric is to provide profitable support for smallholder farmers and enable food production efforts, leveraging technology. So this partnership with Visa is a testament to the work we have put in so far and we look forward to scaling our solutions to more farmers.“

ThriveAgric is a technology-driven agricultural company passionate about food security, that enables strategic partnerships with financial institutions & agriculture value chain players to provide smallholder farmers with capital (in form of agriculture inputs), data-driven best practices, access to local & global markets for their commodities, as well as financial, e-commerce, and payment services.

CarePay is an aggregator of health services, driving accessibility and affordability of healthcare services through insurance and discount plans.