A database allegedly containing the personal information of 15 million people in Kazakhstan has appeared on the dark web. The seller is asking 0.5 bitcoin, about $32,000, for a dataset containing tens of millions of records. The seller claims the information was obtained after hacking the government’s eGov portal. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development has not confirmed that account. Specialists are examining samples of the database and trying to determine where the data came from.
The sale was reported by the Russian Telegram channel Mash. According to the channel, the file is about 2.7 GB and contains 47 million rows. Its description lists passport details, phone numbers, email addresses, places of employment, passwords, and scans of documents.
The claim that the database contains information on 15 million people has not been independently confirmed.
Kazakhstan’s Ministry of Artificial Intelligence and Digital Development disputes the allegation that eGov was hacked. It said a preliminary review had found no evidence that government e-services were breached, and that officials were examining samples of the data to determine where they came from.
The ministry has also questioned parts of the database description. For example, eGov does not store scanned copies of passports in the form described by the seller, while digital documents have a different structure.
The allegation follows at least two other major cases involving personal data in the past 14 months.
In June 2025, around 16 million records containing the names, individual identification numbers, addresses, and phone numbers of Kazakhstani citizens were found to be publicly accessible. The Health Ministry later said the dataset had been compiled from various sources, possibly including the information systems of medical organizations. It said any information originating from medical systems dated from before April 1, 2024.
The Digital Ministry later reported that the investigation had found no signs of a direct hack. According to the ministry, much of the information had been extracted in 2022, possibly by someone with legitimate access to personal data or by a third party using credentials that had been shared or stolen.
The investigation into that leak has still not been completed. In April 2026, the National Security Committee said the criminal case remained under investigation. The agency disclosed no further details, citing the confidentiality of the investigation.
The allegation comes just two months after police seized another large database containing personal information on nearly 16 million Kazakhstanis from employees of a collection agency in the Zhetysu region. It is not known whether the two datasets are connected.
Investigators must therefore establish whether the database offered for sale is authentic and how recent its contents are. The 2025 case showed how information from different sources and different years can be combined into a single database, meaning a large file offered for sale does not necessarily represent a new breach.
There is reason to take such reports seriously. According to KZ-CERT data cited by research agency Finprom, Kazakhstan recorded 9,400 information security incidents in the first three months of 2026. Nearly four out of five involved viruses, computer worms, and Trojan malware.
The allegation comes at an awkward time as Kazakhstan expands the use of artificial intelligence (AI) across public administration. The government has made AI a central part of its economic strategy and is investing heavily in the infrastructure needed to support it. As The Times of Central Asia reported this week, eGov GPT is being expanded across public services, while algorithms are being introduced to match unemployed people with jobs and help identify potential recipients of social assistance.
The government’s growing use of AI does not mean the advertised database came from eGov. However, as more public services use citizens’ personal information, the state’s AI plans depend on secure data storage and controls against unauthorized access. Repeated cases involving data on millions of people may damage public confidence in the government’s AI program, even when a leak originates outside its systems.
The scale of the alleged Kazakhstan leak is significant, although some international breaches have been much larger. In December 2016, Yahoo said that data from more than 1 billion accounts had been stolen in a 2013 attack. The company later revised the figure to all 3 billion accounts then in existence. A 2017 breach at U.S. credit reporting agency Equifax exposed the personal information of approximately 147 million people. In 2019, Equifax agreed to pay at least $575 million in a settlement with U.S. federal regulators, with the total potentially reaching $700 million.
Kazakhstan’s Digital Ministry has said it will release the results of its review once the technical analysis is complete. Until then, it is advising people not to share SMS verification codes, passwords, or electronic digital signature credentials with others, to avoid suspicious links, and to use different passwords for different services.
The main unanswered question is where the dataset offered for sale came from. If it consists of older records compiled from several sources, the claim that eGov was hacked may simply be an attempt to increase the database’s value. If specialists find recent data, they will need to determine where and when it was obtained.
