The Auditor-General’s July 2024–June 2025 SHIF report flagged concerns about outstanding claims reserves, payments under the Public Officers Medical Scheme, and manual verification processes used during the digital transition. On March 10th Daily Nation published a front page headline “Sh50 billion SHArip-off” sparking widespread debate on X (formerly Twitter).
Within hours of Daily Nation publishing a headline, something unusual happened on X . The hashtag #DailyNationSHALies exploded from near-zero activity to 5,409 posts in a single day, driven by 427 accounts. At the bottom of all posts in the campaign, the phrase “Fact checking the nation” and “SHA works”.
Piga Firimbi analyzed the accounts and posts on X driving the #DailyNationSHAlies hashtag, between March 9 and March 17, 2026, discovering a well-coordinated campaign showing clear signs of an influence operation.
BACKGROUND: THE HEADLINE AND THE HEALTH AUTHORITY
Kenya’s Social Health Authority (SHA) was established as the successor to the National Health Insurance Fund (NHIF) following sweeping healthcare reforms. The transition, which involved migrating millions of beneficiary records, restructuring payment systems, and implementing new digital controls, has been politically contentious since its inception. According to Health C.S Aden Duale, by mid-February 2026, the Social Health Authority (S.H.A) had enrolled 29.7 million Kenyans, collected Ksh142.78 billion and disbursed Sh102.3 billion.
Political leaders, including former DP Rigathi Gachagua, have criticised the Ksh104 billion digital national health scheme. The report by the Auditor-General highlights a financial sustainability crisis, with KSh 57.7 billion in contributions against KSh 91.5 billion in benefits paid resulting in a deficit of KSh 38.2 billion. This reflects a payout ratio of 158%, meaning the SHA is disbursing KSh 1.58 for every KSh 1 collected.
The following table provides a comprehensive comparison of each major claim category in Nation’s article showing what the Auditor General found, and how the Health C.S Aden Duale responded.
| # | Category & Amount | AG Finding | Health CS Response |
| 1 | Irregular Transfers & Unexplained Variance (Ksh 4.40 Billion) | • Irregular transfer of Ksh 1.3B from SHIF to defunct NHIF (Jan-June 2025).
• SHIF reported transferring Ksh 7.3B to SHA, but SHA only recorded receiving Ksh 3.9B, leaving Ksh 3.3B unaccounted for. • No satisfactory explanation for the destination. |
• Legally mandated transfer of assets during transition.
• “Moving public funds between government accounts during a transition is not ‘untraced’—it is compliance.” • Part of formal NHIF to SHA system migration. |
| 2 | Unsupported Outstanding Claims Reserve (Ksh 26.84 Billion) | • Ksh 26.8B in payments lacked supporting documents to prove services were rendered.
• Constituted 29.3% of total disbursements. • Insufficient evidence to support claims at time of audit. |
• Money set aside (reserved) to pay hospitals for patients already treated.
• Hospitals had not yet submitted final invoices by close of audit. • Normal accounting practice for accrued liabilities; not lost or misappropriated. |
| 3 | Unauthorized Medical Services (Ksh 7.32 Billion) | • Paid to 1,091 facilities for services not authorized under SHIF benefits package.
• Services fell outside the approved scope of coverage. • Raised questions about oversight and validation. |
• Misunderstanding of different schemes;
Public Officers Medical Scheme has an enhanced, broader package. • Specialized surgeries/air evacuations are covered under that specific scheme. • Not unauthorized, just different coverage levels. |
| 4 | Non-Contracted Facilities (Ksh 1.57 Billion) | • Disbursed to 137 facilities not formally contracted by SHA.
• Violated standard procurement/contracting procedures. • Lacked legal framework for payment. |
• Payments made during transition (Oct 2024).
• NHIF-contracted hospitals were allowed to continue treating patients to avoid turning them away. • Policy decision to ensure continuity of care during digital processing. |
| 5 | Impossible Maternity Claims (Ksh 148 Million) | • 6,392 cases of repeat childbirth flagged as medically impossible.
• One case: single patient recorded delivering 10 babies in one year. • Indicates systematic fraud or system failure. |
• Attributed to complex initial transition period.
• Temporary reliance on manual validation led to frequency limit errors. • System now configured to strictly prevent repeat claims; clinical review ongoing. |
| 6 | Impossible Surgical Claims (Ksh 445 Million) | • 3,235 instances of SHIF paying for multiple open-heart surgeries on the same patient in a single day.
• Clear indication of fraudulent billing or catastrophic system failure. |
• Attributed to manual validation challenges during migration.
• Recovery actions: Ksh 305.8M recouped via surcharges; Ksh 3.2M via ADR. • Processes underway to recover remaining Ksh 817.3M. |
| 7 | Systemic Over-Approvals (Ksh 2.4 Million / 1.4 Billion) | • 227 cases of overpayments (Ksh 2.4M).
• 50,045 claims with lumped codes resulted in an additional Ksh 1.4B in overpayments. • System approved payments exceeding gazetted rates. |
• Digital system matches payments to official gazetted tariff rates.
• When clerks manually key in a lower amount by mistake, the system auto-corrects upward to statutory levels. • Feature intended to prevent underpayment, not overpayment. |
| 8 | Lumped service codes (p.2)
Ksh 1.45 Billion |
Multiple services bundled into single claim entries, causing overpayment. | |
| 9 | Ungazetted service codes (p.4)
Ksh 4.78 Billion |
Services approved under codes that were never officially published or authorized. | |
| 10 | Fund payables variance (p.6)
Ksh 1.67 Billion |
Another accounting mismatch between fund records. | |
| 11 | Manual claims outside system (p.6-7)
Ksh 366.3 Million |
Claims processed manually outside the automated control system. |
BREAKDOWN OF NATION’S “50 BILLION SHA RIP OFF” HEADLINE
Screengrab of Nation’s article showing the breakdown the “50 Billion SHA rip off headline”
COORDINATION VS. DISCOURSE
This trend exploded with widespread retweets and mentions, attracting 1.1M estimated impressions and 7.79M estimated reach. Notably, there was a high level of uniformity in the visuals used. Multiple posts, including those from the account @mwakalakapkempu, shared identical graphics within a minute of each other (10:36 AM – 10:37 AM) but carried slightly altered captions. According to the DISARM framework, the coordination mirrors tactics designed to flood timelines and manufacture the appearance of organic engagement.
Piga Firimbi investigated the posts and uncovered 15 accounts on X that collectively amassed over 12.7 million views. Posts with the hashtag “#DailyNationSHALies” and “Hakuna Scandal” racked up 5,190 total engagements and 90,100 views with the first post shared on March 10th by Mulwa Jr at 10:33 AM.
The Echoing Health C.S narrative of dismissing claims of disbursement of paying to uncontracted facilities KSh 1.56 billion (Claim 4) and KSh 2.4 million (Claim 5) in overpayments.
A CAMPAIGN THAT LIVED AND DIED IN 24 HOURS
The timeline tells a striking story. On March 9, the day before the campaign ignited, just 2 posts were recorded. On March 10, that number surged to 5,409, representing 96.8% of all activity in the entire nine-day dataset. By March 11, volume had crashed to 167 posts. From March 12 onward, daily activity never exceeded single digits.
| Date | Posts | Unique Users |
| March 9 | 2 | 2 |
| March 10 | 5,409 | 427 |
| March 11 | 167 | 83 |
| March 12 | 2 | 2 |
| March 13–17 | 10 | 10 |
This pattern, a single massive spike followed by near-total silence, is inconsistent with genuine public outrage, which typically builds over days and declines gradually. It is, however, consistent with a coordinated campaign that was activated, executed, and then abandoned once its purpose was served.
The graph showing daily activity against posts volume
https://public.flourish.studio/visualisation/28693881/
Zooming into the peak hour reveals the operation’s precision. At 11:00 a.m. on March 10, the platform recorded 2,701 posts from 145 users. The adjacent hours of 10:00 a.m. (352 posts) and noon (1,613 posts) were also heavily active, meaning that roughly 84% of the entire campaign (4,666 of 5,590 posts) occurred in a three-hour window.
Graph showing hourly activity against posts
The minute-level data is even more telling. The analysis identified 48 clusters where three or more accounts posted identical content within the same 60-second window. The most intense burst occurred between 11:50 a.m. and 12:06 p.m., with multiple consecutive minutes each producing 80 to 143 posts. This level of synchronisation is virtually impossible without coordination, whether through shared scheduling tools, group directives, or automated systems.
Minuted data analysis of posts between 11:50 a.m. and 12:06 p.m.
Specific same-minute clusters reveal accounts that consistently appear together. For example, the handles @_itsjed_, @its_meek__, @punny_biz, and @engina_jc repeatedly posted identical retweets within the same minute at 11:28 a.m. across multiple different source tweets. This pattern suggests these accounts were operating from a shared queue or instruction set.
THE AMPLIFICATION MACHINE: REPOSTS DOMINATE
Of the 5,590 posts in the dataset, the content breakdown reveals an amplification-heavy structure:
| Content Type | Count | Share |
| Repost (retweet) | 3,390 | 60.6% |
| Original post | 1,551 | 27.7% |
| Reply | 608 | 10.9% |
| Quote tweet | 41 | 0.7% |
On the peak day alone, 3,310 of 5,409 posts (61.2%) were reposts. This suggests that the campaign relied on a small cadre of content creators whose messages were then systematically amplified by a larger network of distribution accounts.
HUB-AND-SPOKE: THE NETWORK’S ARCHITECTURE
The retweet targeting data reveals a classic hub-and-spoke amplification model. A small number of accounts generated original content that was then reposted en masse by a much larger group.
Top content hubs by reposts received:
| Account | Reposts Received | Original Posts | Total Posts |
| @JebetKe_ | 202 | 23 | 29 |
| @amala254 | 177 | 21 | 23 |
| @mwalakapkembu | 132 | 38 | 115 |
| Dr. Mumbi Seraki | 128 | ||
| @Jaberiented | 111 | 17 | 26 |
| @bonsoul_ke | 109 | 14 | 39 |
| @khadija34020960 | 100 | 28 | 28 |
| @realkahiro | 98 | 18 | 22 |
| @naledifusion | 86 | 16 | 25 |
(Interactive flourish template )
These “hub” accounts share a distinctive profile: they posted a moderate number of mostly original messages and received disproportionately high amplification. Notably, @JebetKe_ posted only 29 times but received 202 reposts, while @amala254 posted 23 times but received 177 reposts, a repost-to-post ratio of approximately 7:1 and 8:1 respectively. These ratios suggest that their content was pre-selected for amplification by the broader network.
Conversely, @khadija34020960 (displayed as “Didmus Barasa Commentary”) posted 28 entirely original messages and received 100 reposts despite a listed reach of only 23,100. This engagement-to-reach ratio is anomalously high and consistent with coordinated boosting rather than organic viral spread.
THE AMPLIFIER ACCOUNTS: VOLUME WITHOUT ENGAGEMENT
At the opposite end of the network sit the amplifier accounts ( high-volume posters) whose primary function appears to be boosting others’ content:
| Account | Total Posts | Reposts Made | Repost Ratio | Engagement
Received |
|---|---|---|---|---|
| @rolexrono | 264 | 230 | 87.1% | 489 |
| @_jahom | 163 | 136 | 83.4% | 498 |
| @ruto_nated | 124 | |||
| @mwalakapmbu | 115 | |||
| @nbreadwinner001 | 115 | |||
| @ivycherop1921 | 108 | 103 | 95.4% | 8 |
| @kanairofinest | 107 | 97 | 90.7% | 111 |
| @wamunyini26 | 99 | |||
| @jiminjimis81636 | 98 | |||
| Sexy monicah | 96 | |||
| @ke_johnnieh | 65 | 65 | 100% | 0 |
Several patterns stand out:
- @ke_johnnieh posted 65 times ( every single one a repost) and received zero engagement. This is a near-textbook amplifier profile.
- @ivycherop1921 and @jiminjimis81636 each posted around 100 times with repost ratios above 94%, yet received only 8 engagement actions each. These accounts functioned as pure signal boosters .
- @rolexrono, the single most active account with 264 posts, produced 230 reposts (87%) and received only 489 total engagement, roughly 1.9 engagement actions per post, an extremely low ratio for an account posting at that volume.
The disconnect between posting volume and engagement received is a well-documented indicator of inauthentic amplification behaviour. Genuine high-volume users typically generate engagement proportional to their activity; accounts that post prolifically but attract almost no interaction are consistent with being part of a managed amplification network.
CONTENT DUPLICATION: 656 CLUSTERS OF IDENTICAL MESSAGES
The most direct evidence of coordination lies in the content itself. The analysis identified 656 distinct clusters where the exact same text was posted or reposted by three or more users. This is not merely a popular tweet being organically shared; the clusters reveal verbatim copy-paste behaviour across dozens of accounts with no meaningful personalisation.
Selected examples illustrate the pattern:
- 109 accounts posted an identical message about mineral scanning in Kajiado East, spanning 105 unique users over approximately 97 hours, a deflection narrative linking the SHA story to unrelated controversies.
- 25 accounts reposted identical text from @Jaberiented: “Digital health financing systems provide stronger oversight than traditional manual processes. SHA’s new digital tools help prevent misuse and reinforce the truth that Hakuna Scandal.”
- 23 accounts shared nearly identical wording: “headline regarding a Sh50 billion rip-off is a fundamental misinterpretation of the Auditor General’s recent findings. These reports incorrectly frame standard operational challenges as a coordinated financial heist.”
- 21 accounts simultaneously circulated: “SHA is legally bound to follow these global accounting standards to maintain transparency and international credibility. Adhering to these rules should be seen as a sign of professionalism rather than a cause for alarm.”
The language across these clusters is strikingly uniform, polished, policy-literate, and defensive rather than conversational. Several clusters employ technical accounting terminology (“Outstanding Claims Reserve,” “IFRS 17,” “claim reserves”) in ways that suggest centrally drafted talking points rather than spontaneous public commentary.
Network diagram showing message clustering of accounts
NARRATIVE DISCIPLINE: A COORDINATED MESSAGING PLAYBOOK
Perhaps the most revealing indicator of coordination is the thematic discipline of the campaign. Rather than the chaotic, multi-directional discourse typical of organic public anger, the posts cluster tightly around a small number of defensive narratives:
| Narrative Category | Posts | Users | Engagement |
| Accounting / audit
technical explanation |
792 | 153 | 6,387 |
| Transition / rollout issues framed as temporary | 673 | 136 | 6,221 |
| Political deflection / partisan messaging | 475 | 141 | 38,303 |
| Pro-SHA reform / government defense | 462 | 111 | 4,430 |
| Public officers medical scheme defense | 432 | 114 | 7,616 |
| Attack on Daily Nation / media credibility | 190 | 73 | 1,152 |
| Deflection to other controversy / conspiracy | 109 | 105 | 12,225 |
Narrative categories showing the amount of posts
AUDITOR GENERAL AND MEDIA NARRATIVE
The Auditor-General issued a disclaimer of opinion on the SHA audit covering June to July, meaning the office could not obtain sufficient verified data to confirm the accuracy of SHA’s financial statements. This does not in itself prove fraud, but it signals serious gaps in record-keeping, transparency, and governance raising concerns that go beyond routine accounting issues.
Auditor General’s disclaimer of opinion on the 2024–June 2025 SHIFreport.
Despite these red flags, Health Cabinet Secretary Aden Duale characterised the findings as “standard accounting,” effectively downplaying the risks and accountability concerns highlighted in the audit.
In April 2026 Health C.S appeared in front of a senate committee and talked on fraud saying the DCI has more files including claim of maternity
Media coverage diverged in its interpretation of the Auditor General’s report. Nation Media Group presented the audit findings with a level of certainty “Ksh. 50 Billion SHA Rip Off” while the evidence does not support. Complex issues such as possible financial inconsistencies, missing documentation, and reserve discrepancies were often simplified into claims of outright “theft.”
The star echoed Hon. Aden Duale’s statements of dismissing the Nation Headline while President Ruto dismissed the Auditor General’s claims, arguing that the noise is generated by beneficiaries of the “previous fraudulent National Health Insurance Fund (NHIF) system”. At the same time, the government moved quickly to shape the narrative, including through amplified messaging on social media aimed at countering critical reporting. This shifted attention away from the core audit concerns and toward defending institutional credibility.
This interplay where technical audit findings are simplified into headline claims, and official responses minimize the implications distorts public understanding. In such an environment, amplification often outweighs accuracy and by the time clarifications emerge, initial narratives already have influenced public perception. In that vacuum, both media framing and coordinated online messaging do not just reflect reality they actively shape how it is understood. Therefore, the claims are MISLEADING.
DECODING THE LANGUAGE
At the centre of this campaign is the hashtag #DailyNationSHALies, which functions as a rallying point for amplification. Supporting phrases such as “hakuna scandal hapa” (there is no scandal here) are repeatedly deployed to construct an echo chamber that directly counters allegations raised in the Auditor-General’s report. This framing relies on outright denial, recasting audit concerns as misinformation and reframing the alleged “rip-off” as necessary “system stabilization.” from SHIF to SHA.
Words Used in Posts Condemning Nation Media Group
Hanifa emerged as a keyword during the #DailyNationShaLies conversation on March 9, coinciding with her undergoing surgery for a worsening ear condition. Despite publicly sharing her situation, she became a target of criticism on X. Several accounts alleged that the Social Health Authority (SHA) had covered her medical expenses, framing her as a beneficiary of a system she has been critical of.
However, the Kenyan activist and social media influencer Hanifa Adan refuted these claims stating that the SHA did not cover any part of her medical bill. She clarified that her surgery was partially covered by her private insurer.
The language deployed in the disinformation campaign targeting Daily Nation’s “Sh50 billion SHA rip-off” story follows a familiar pattern previously observed by Piga Firimbi in coordinated attacks against media organisations like Africa Uncensored and Nation Media Group. This is not an isolated incident, but part of a recurring strategy where media houses face coordinated backlash when their reporting challenges pro-government narratives.
METHODOLOGY
The dataset analysed for this investigation comprises 5,590 records scraped from X using keyword and hashtag tracking, specifically the terms “DailyNationSHALies” and “hakuna scandal”. The data spans March 9–17, 2026, and includes metadata on content type, author handle, posting time, hashtags, engagement metrics (likes, reposts, replies, views), geographic tags, and text content.
Limitations should be noted: the dataset reflects a hashtag-filtered collection, not a full platform capture. Account creation dates, follower counts, and verification status were unavailable, constraining the ability to identify newly created or bot-like accounts with certainty.
This article was produced with research and data analysis by Moffin Njoroge of Code for Africa’s iLab.
Add comment