Safaricom Detected 1.25 Billion Cyberattack Attempts in 2026

Safaricom’s 2026 Sustainable Business Report is hardly about sustainability, but it gives a detailed account of how the company’s technology runs. Safaricom ended the year with 57.93 million customers in Kenya (up 20.1%) and 13.6 million in Ethiopia.

M-PESA processed 46.41 billion transactions worth KES 41.68 trillion. Transaction count rose 25.1%, while value rose only 8.9%. Thirty-day active customers grew from 35.8 million to 41.7 million. That averages roughly 1,470 transactions a second all year.

The Fintech 2.0 rebuild lifted capacity from 4,500 to 6,000 transactions per second, with room to scale past 12,000. Reported availability is 99.999%, or about five minutes of downtime a year.

The gap between count and value growth points to smaller payments. The likely driver is M-PESA Kadogo, which makes small transfers (up to KES 100) and merchant payments (up to KES 200) free. It accounted for 17.1 billion transactions, 36.8% of all volume.

Developer activity also grew with 89,780 integrations and 149,834 developers. The Daraja 3.0 platform added security APIs for fraud detection and identity verification.

Metric	FY26	FY25 / change
Transactions	46.41 billion	37.10 billion (up 25.1%)
Transaction value	Ksh 41.68 trillion	Ksh 38.27 trillion (up 8.9%)
30-day active customers	41.7 million	35.8 million
Processing capacity	6,000 transactions/sec	4,500; can scale past 12,000
Availability	99.999%	n/a
Kadogo free transactions	17.1 billion	36.8% of all volume
Developer integrations	89,780	55,000
Developers	149,834	106,000
Fuliza borrowing base	18.1 million	7 million
Ziidi active investors	2.2 million	n/a
Wealth assets under management	Ksh 21.1 billion	Ksh 9.8 billion
Ziidi Trader subscribers	84,000	Launched February 2026
Taasi Till non-performing loans	8%	n/a

Ziidi lets people invest from KES 100. It has 2.2 million active investors and KES 21.1 billion in assets, up from 9.8 billion. Ziidi Trader, launched in February 2026, allows NSE share trading from a phone, with 84,000 trading subscribers by year end.

The Fuliza overdraft base grew from 7 million to 18.1 million customers, including 11 million who previously had a zero limit. Credit decisions use AI-supported models with human oversight.

The Safaricom report is open about the downside as Taasi Till, a merchant credit product, has an 8% non-performing loan ratio, which is prompting tighter controls and more purchase-linked credit in FY27.

Safaricom detected about 1.25 billion intrusion attempts and investigated more than 130,000 security events. The company reports no confirmed material breaches and says DDoS attacks were mitigated without material customer impact. These are self-reported figures.

The Cyber Defence Centre is being modernized with a next-generation SIEM, AI-powered defense and an in-house threat-intelligence platform. A zero-trust model is the next priority, and ISO 42001 (AI management) certification is planned for FY27.

Privacy changes were the most visible to users. M-PESA person-to-person data minimization finished in March 2026, so sender notifications now show two names and a masked number, covering more than 40 million subscribers.

Fraud incidents fell 82% against a 90% target, and 46% of reported fraud losses were recovered. In-person social engineering was the biggest single contributor to fraud.

A SIM swap rebuild cut pre-checks from 21 clicks to four and automated 18 fraud and compliance checks. Franchise-related SIM swap fraud fell from about 20 incidents a month to fewer than five.

Metric	FY26
Intrusion attempts detected	About 1.25 billion
Security events investigated	More than 130,000
Confirmed material breaches	None reported
Subscribers covered by P2P data minimisation	More than 40 million
Merchant customer data masked	94%
Fraud incident reduction	82% (target 90%)
Reported fraud losses recovered	46%
Agent commission losses recovered	Ksh 953 million
Staff dismissed for fraud	118 (FY25: 113)
M-PESA privacy trust score	70% (low of 63% in FY25)
Safaricom privacy trust score	61% (low of 56% in FY25)

Population coverage is 98.6% for 2G and 3G, 97.9% for 4G and 30% for 5G. Safaricom has 1,879 5G sites and 21,000km of metro fibre. LTE on 700 MHz is deployed at about 62% of sites.

Pre-connectorised fibre components (fibre-optic cables and accessories supplied with connectors already fitted, making them ready to plug in) covered 25,000 homes and are estimated to cut deployment costs by 15% to 30%.

Reliability improved. Average service unavailability fell from 38.32 to 26.64 minutes (down 30%), and major incidents fell 25%. Customer perception was mixed.

Overall network NPS (measure of customer satisfaction) rose from 75 to 77, and data speed improved. Voice quality fell from 84 to 80, and data coverage fell from 70 to 66.

Access and affordability efforts include:

• Tokenised Wi-Fi from KES 10 an hour
• Time-based mobile browsing
• A fall in average data price per MB to 5.44 cents from 6.19 cents
• A low-Earth-orbit satellite backhaul trial
• Local device assembly of 644,000 devices

Power is the main constraint on the network. The average energy mix is 78% grid, 5% solar and 17% diesel. Solar-equipped sites rose from 1,432 to 2,028, and about 800 sites got lithium-ion batteries and modern rectifiers.

Diesel use fell 3.7%, but electricity use rose to 274,531 MWh. An AI/ML carrier-shutdown tool saves up to 8% of radio network energy.

Data centers average a Power Usage Effectiveness of 1.6. The new Limuru facility’s first phase recorded 1.25.

Emissions are heading the wrong way in Kenya. Scope 1 and 2 emissions rose 9.1% to 56,354 tCO2e, and diesel is still 79.74% of Scope 1. The 2030 targets are 5,000 solar sites and 95% green energy, against 2,028 sites and 35.7% today.

The report doesn’t explain how the 35.7% is calculated, and it doesn’t line up neatly with the 5% solar share.

Metric	FY26	FY25 / target
Solar-equipped sites	2,028	1,432 (2030 target: 5,000)
Network energy mix	78% grid, 5% solar, 17% diesel	n/a
Electricity use	274,531 MWh	259,715 MWh
Diesel use	About 10.08 million litres	Down 3.7%
Sites modernised (batteries, rectifiers)	About 800	n/a
Data centre average PUE	1.6	Limuru Phase 1: 1.25
Scope 1 emissions	33,854 tCO2e	30,160 tCO2e
Scope 2 emissions	22,500 tCO2e	21,478 tCO2e
Scope 1 and 2 total	56,354 tCO2e	Up 9.1% from 51,638
Reported green energy	35.7%	2030 target: 95%

More than 70 AI/ML models are in production, and agentic AI moved from pilot to production in FY26. Uses include the Zuri assistant, fraud detection, credit scoring, churn prediction and network planning.

OneApp, the super-app, has 4.06 million active users, 107 Mini Apps and KES 4 billion in revenue, though the report concedes usability problems.

Safaricom also names AI risks, including model fairness in credit and exposure from autonomous agents but notes that Kenya has no dedicated AI law.

Safaricom hosts e-Citizen (more than 15,000 services with M-PESA payments) and led the Health Information Exchange, which handles about 130,000 transactions a day. It also built the ambulance dispatch platform.

In Ethiopia, Safaricom has 3,504 sites and about 59% population coverage. It expects break-even in FY27. Energy is 88.84% grid, 9.67% solar and 1.49% diesel, and about 98% of consumption is renewable thanks to a hydro-heavy grid.