A transport company seeking Sh1.5 billion in damages from Absa Bank Kenya over an alleged data breach has told the court it has engaged an independent auditor to quantify the financial losses it claims to have suffered following the alleged unlawful disclosure of its confidential banking records to a third party.
New Mega Africa, which is suing the bank over the alleged breach, sought more time to present the auditor’s expert report, telling the court that the auditor is currently undertaking field assignments outside the country.
At the same time, one of the bank’s intended witness has withdrawn from the case, citing personal reasons. In a letter copied to the parties and the court, Ms Sophie Omondi said the proceedings had taken a toll on her personal life and that she wished to move on.
“For the foregoing reasons, I wish to withdraw as a witness in the case,” she said.
She indicated that the decision also applied to a related case involving the same parties pending before a Nairobi court.
The developments came as former Absa Bank Coast Region Sector Head for Business Banking Mr Evans Murumba testified that New Mega Africa’s confidential financial information was disclosed to third parties in breach of customer confidentiality, evidence the company says supports its claim that the alleged data breach caused it substantial financial losses.
Mr Murumba told the court that New Mega Africa had been a strong performing customer whose credit facilities were progressively increased after the bank established that the business was financially sound.
According to him, the company’s fortunes changed during the Covid-19 pandemic after its key client, Tororo Cement, extended its payment period, straining the transporter’s cash flow and forcing it to seek an extension of its temporary overdraft before later applying for a restructuring of its credit facilities.
“I do confirm that the bank gave the company a temporary overdraft line as it looked for a suitable supplier who will not only take the guarantee on the new terms but also give it an extra limit of Sh5 million to cushion it in the short run,” said Mr Murumba.
He said that despite recommending the restructuring request and assuring the company that approval would be secured within seven days, the process stalled following the transfer of the client’s relationship from one manager to another.
Mr Murumba testified that the delays coincided with what he described as an unlawful disclosure of the company’s confidential financial information by then relationship manager, Mr Wycliffe Makori, to a third party.
He said that after a meeting at the company’s offices attended by himself, Mr Wycliffe Makori and the then incoming relationship manager, Ms Omondi, the bank assured the company that its restructuring request would be processed urgently.
However, about an hour after the meeting, the company’s director, Mr David Abai, telephoned him to report that he had received a call from Mr Jared Makori, then the Kenya National Highways Authority regional manager.
According to Mr Murumba, Mr Jared Makori informed him (Mr Abai) that Mr Wycliffe Makori had disclosed that New Mega Africa was facing financial difficulties, that the bank was considering recalling its credit facilities and auctioning its securities, and warned him against entering into any financial dealings with the company.
“The purpose of the call was to warn him against any potential financial dealings with the company. Mr Wycliffe Makori further advised Mr Jared Makori to inform all other friends or businesses who would potentially enter into any financial dealings with the plaintiff to exercise extreme caution,” Mr Murumba said.
He testified that he considered the disclosure a blatant breach of customer confidentiality, duty of care and data protection laws.
He added that when he summoned Mr Wycliffe Makori to explain himself, the relationship manager admitted making the call.
“The actions by Mr Wycliffe Makori were, in my view, not in good faith and amounted to utter misconduct. When reviewed alongside his reluctance to hand over the client relationship to Ms Omondi, I found it deeply disturbing because it amounted to a blatant breach of client confidentiality, duty of care and data protection laws, mainly intended to cause panic and reputational damage to the client among its business associates,” Mr Murumba said in his witness statement adopted as evidence.
Absa Bank has denied the allegations.
Although he escalated the matter for investigations and disciplinary action, Murumba said he was later informed that the bank had concluded there was no material risk arising from the disclosure and recommended no further action.
“I was also cautioned that admitting such an allegation to the company director or even taking disciplinary action would be tantamount to the bank admitting liability,” he testified.
Murumba further told the court that opposition to the company’s restructuring request later intensified after concerns were raised internally over its ownership structure, despite his disagreement with those concerns.
He said the prolonged delays left the company unable to obtain additional financing while all its assets remained charged to the bank, eventually crippling its operations.
“I watched the company’s business crumble due to its inability to execute the existing contracts. The most significant one was the repossession of the eleven brand new trucks that had been leased to it by Mombasa Cement,” he said.
Murumba added that after issuing Wycliffe with a verbal warning and raising concerns over the bank’s handling of the matter, he began experiencing resistance in pursuing the company’s restructuring request.
“As a longstanding banker, I am aware that all banks, including Absa, train their staff on the legal implications of failing to protect client information, including obligations relating to data protection, duty of care and customer confidentiality,” he said.
Mr Jared also testified, confirming that Wycliffe had called him and discussed New Mega Africa’s financial position.
“The conversation happened. I can confirm,” he said.
However, when questioned by the bank’s lawyer, he said he had no recording of the conversation.
He also denied having any business interest in the company, saying he only knew its director, Mr Abai.
In the suit, New Mega Africa, which transports clinker from Kenya to Tororo, Uganda, for cement manufacture and processing, accuses Absa Bank of financial sabotage by disclosing its confidential financial information to third parties without its consent.
The company alleges the bank breached its duty of confidentiality by printing and sharing its financial statements without authority, exposing sensitive information to strangers.
It further claims that the bank’s failure to approve its loan restructuring request promptly, coupled with prolonged delays in responding to repeated requests, crippled its operations.
According to the company, the leaked financial information scared away potential financiers, who declined to extend credit after concluding that it was financially distressed and incapable of servicing additional loans.
Absa Bank has denied the allegations, maintaining that neither it nor its employees disclosed the company’s financial information or warned third parties about its financial position.
The bank argues that the data breach claims are baseless and without merit, adding that internal investigations found no evidence of wrongdoing by the bank or any of its staff.