Most people picture a bank robbery as something loud and fast — a masked gang rushing through the front doors demanding cash before sirens arrive. What happened at the Kenya Commercial Bank branch in Thika in November 2017 looked nothing like that. It was slow, patient, and almost invisible, which is exactly what made it so effective, and exactly why it remains one of the more instructive case studies in vault security anywhere in East Africa.
When the branch manager, Samuel Ng'ang'a, opened the strongroom on the morning of Monday, 20 November 2017, he found two safes broken open and roughly Sh50 million gone. There had been no alarm, no broken front door, no obvious sign of forced entry anywhere a guard or camera would normally be watching. The thieves had not come through the door at all. They had come from underneath.
How the Thika Tunnel Heist Actually Happened
According to police and media reporting at the time, a group of suspects rented a bookshop stall at a small commercial building across from the KCB branch, close to the Thika police station itself, several months before the theft. From that stall, they dug a tunnel roughly 30 metres long, reportedly reinforced with wooden planks and metal rails to keep it from collapsing, running underground until it broke directly into the bank's strongroom. Investigators later found welding equipment, an oxy-acetylene gas cylinder, and other tools at the scene, and it is believed the group used cutting flames to burn through the two safes once inside.
Three suspects were arrested in the days following the discovery, and part of the stolen cash, more than Sh17 million, was recovered from a rented house in Juja after the suspects reportedly led investigators there. It is worth noting that those arrested denied involvement in the theft when they appeared in court and were released on bond, and it would be inaccurate to state their guilt as an established fact here, since that determination rests with the courts. What is well documented, regardless of who is ultimately held responsible, is the method itself: a slow, engineered tunnel that bypassed every conventional security measure the bank had in place simply by going around them entirely.
Why This Case Still Matters for Vault Security Today
The Thika heist is worth revisiting today because it exposes an assumption that a lot of businesses, not just banks, still quietly rely on: the idea that thick walls, a heavy door, and a working lock are enough to call a space secure. A vault door can be the strongest piece of engineering in a building and still be irrelevant if an intruder never has to open it, because they have entered through a wall, a floor, or a ceiling instead.
This is not a uniquely Kenyan problem. Tunnel-based robberies of exactly this kind have happened at banks around the world, and they share a common thread. Perimeter security built around a single access point, the front door or the main gate, creates a kind of tunnel vision of its own, where enormous effort goes into controlling who walks through that one entrance while the rest of the building's boundary — walls, floors, ceilings, and adjoining structures — receives comparatively little attention. In the Thika case, the tunnel took months to complete, according to reporting on when the rented stall was first occupied, which means the digging itself was likely happening gradually over an extended period without triggering any response.
Where the Real Security Gap Was
Set aside the tunnel itself for a moment and look at what actually failed here, because it is more specific than "the bank was robbed." The strongroom had no way of detecting unauthorised entry that did not happen through its designated door. There was no system in place capable of noticing unusual vibration or drilling activity building up in the walls or floor over an extended period. And critically, the theft was not discovered in real time at all. It was only found the following morning when a staff member physically opened the vault, meaning the thieves had the entire overnight window, and quite possibly longer, to work without anyone knowing anything was wrong.
That gap between when a breach happens and when someone actually finds out about it is, in many ways, the single most important variable in high-value security. A vault that takes an intruder an hour to breach is not meaningfully safer than one that takes ten minutes if nobody is alerted until the next business day either way.
How Modern Access Control Addresses This Specific Failure
This is where vault and strongroom security has moved on considerably since 2017, and it is worth understanding what a more layered, modern setup actually looks like, since the improvements go well beyond simply installing a better lock.
Dual-custody biometric access with time-scheduled lockdown
Dual-custody biometric access, requiring two separate authorised individuals to present their credentials at the same time before a strongroom door will open, removes the single point of failure that comes with one person holding a key or knowing a combination. Paired with time-scheduled lockdown rules, meaning the door simply will not open outside pre-approved hours regardless of whose credentials are presented, this closes the kind of after-hours access window that made the Thika theft possible in the first place.
Integrated motion and vibration sensing
Integrated motion and vibration sensing is the part of this that speaks most directly to what happened in Thika. Passive infrared sensors inside a vault zone can detect unexpected heat signatures, useful for catching intruders who have entered undetected through an unconventional route. Ground vibration and structural sensors go a step further, since they are specifically designed to pick up the kind of sustained drilling, cutting, or tunnelling activity that a break-in through walls or flooring would involve, well before the breach is actually completed. A system built around this kind of sensing does not wait for a door to be opened to raise an alarm. It responds to the physical disturbance itself.
Automated, silent alerting
Automated, silent alerting matters just as much as detection. A loud alarm at the moment of breach can prompt intruders to grab whatever they can and flee quickly, sometimes violently. A system that instead sends an immediate, silent alert to a remote monitoring centre gives security personnel and police a genuine chance to respond while an intrusion is still in progress, rather than learning about it after the fact from an empty vault the next morning.
What This Means for Kenyan Businesses Beyond Banking
While the Thika case involved a major bank, the underlying lesson applies to any Kenyan business storing high-value goods, cash, or sensitive materials in a fixed location. Jewellers, forex bureaus, pawn shops, large retailers with cash offices, and warehouses holding valuable inventory all share the same basic vulnerability if their security planning stops at the front door and the main safe lock. A determined, well-resourced intruder with time on their side will look for the path of least resistance, and in a surprising number of cases, that path is not the one anyone was actually watching.
Assessing this kind of risk properly requires more than a generic security quote. It benefits from an actual site evaluation that considers what is adjacent to a high-value storage area, what kind of activity in neighbouring units or structures could realistically go unnoticed over weeks or months, and whether current systems would actually detect a slow, patient breach rather than only a fast, obvious one. Business owners looking to have this kind of assessment done properly are often better served comparing multiple security providers with genuine experience in this area rather than assuming any standard CCTV and alarm package covers it. At Secuwatch, we help business owners in Kenya find and compare vetted providers offering more advanced strongroom and perimeter security solutions, including biometric access control and vibration-based intrusion detection, which is worth investigating for any facility holding genuinely high-value assets.
A Grounded Conclusion
The Thika tunnel heist remains a striking reminder that physical security is only as strong as its weakest, most overlooked point, and that point is rarely the one everybody assumes it to be. A thick vault door and a good lock protect against the obvious threat while leaving the unconventional one — patient, engineered, and largely invisible until it is too late — completely unaddressed. For any business holding significant value in a fixed location, the real question worth asking is not whether the front door is secure. It is whether an intruder who never touches that door at all would actually be noticed before the damage is already done.