Cybersecurity - The Times Of Central Asia

Viewing results 1 - 6 of 9

Yandex Drone Attack

Drone Strikes on Russian Data Centers Disrupt Yandex Services Across Central Asia

Drone attacks on three Yandex data centers in Russia disrupted taxi, delivery, and other digital services in Kazakhstan, Kyrgyzstan, and Uzbekistan. At the same time, the company said that Kazakh users’ personal data continued to be stored within Kazakhstan. The outages revealed how heavily Central Asia’s digital economy depends on computing infrastructure beyond its borders. Between October 8 and 11, drones attacked three Yandex data centers in Russia. The first facility hit was in Sasovo, in the Ryazan region, where two supercomputers used for artificial intelligence development were located. The center shut down completely. A subsequent strike hit a data center in Kaluga, disabling some of its equipment. On October 11, another attack forced a facility in Vladimir to shut down. Yandex confirmed the damage and said no employees were injured. Company specialists began redistributing computing workloads among the remaining operational sites, but it is not yet known when the damaged equipment will be fully restored. According to Reuters, the strikes on Russian data centers were part of an expansion of attacks on economic and technological infrastructure during Russia’s war against Ukraine. The consequences quickly spread beyond Russia. On October 11, users in Kazakhstan encountered problems ordering taxis, meals, and groceries through Yandex Go, Yandex Eats, and Yandex Lavka. The disruptions also affected scooter rentals and other applications. Drivers and couriers could not receive orders, while restaurants and stores temporarily lost access to some of their customers. Yandex Qazaqstan confirmed the technical problems. By evening, taxi booking was available again, although some functions continued to operate with restrictions. The company explained that when servers fail, computing tasks are transferred to other resources, but switching workloads takes time. Similar disruptions occurred in Kyrgyzstan and Uzbekistan. Users reported errors when booking rides and ordering deliveries, as well as problems displaying fares. In Kyrgyzstan, Yandex’s local division acknowledged the problems and confirmed that damage to infrastructure in one country could disrupt applications in another. For Central Asia, this is more than a temporary inconvenience. Digital platforms have become part of the urban economy, supporting the work of drivers, couriers, restaurants, stores, and delivery services. When an application stops accepting orders, some market participants effectively lose access to customers. However, reliable estimates of financial losses in Kazakhstan, Kyrgyzstan, and Uzbekistan are not yet available. It is unclear how many orders were lost or whether partners will be compensated for their losses. The outages also affected Yandex’s financial services. Dmitry Pirogov, head of the company’s fintech division, said on October 11 that users were temporarily unable to check their balances, pay for purchases, or transfer money through Yandex Pay. According to him, account information is stored in multiple copies, and checks found no loss of records. However, data preservation did not ensure uninterrupted access to financial transactions. This distinction proved particularly important for Kazakhstan. Following the widespread outages, questions arose about why damage to servers in Russia affected applications in Kazakhstan despite local legal requirements to store personal data within the country. Yandex Qazaqstan said...

Railway Digitalization

EBRD Provides €38.4 Million for Digital Transformation of Uzbekistan Railways

The European Bank for Reconstruction and Development (EBRD) will provide a loan of up to €38.4 million to O’zbekiston temir yo’llari (UTY), the country’s national railway operator, to digitalize transport management and improve cybersecurity. According to the EBRD, UTY owns and operates a 6,950-kilometer railway network and is responsible for up to 40% of freight transported in Uzbekistan. Some dispatching and scheduling work remains manual, as do parts of operational control. The financing will allow UTY to introduce modern digital traffic and transportation management systems and upgrade cybersecurity protections for its IT infrastructure. The EBRD said the changes should improve the safety and reliability of railway operations while allowing UTY to manage train movements and network capacity more efficiently and reduce costs. The planned cybersecurity measures will be aligned with international best practices. The Bank also links the project to the development of the Trans-Caspian Transport Corridor, also known as the Middle Corridor, which connects Central Asia with the South Caucasus and onward to Europe. Landlocked Uzbekistan connects to the corridor through neighboring countries before cargo crosses the Caspian Sea. The project is the EBRD’s first public-sector initiative of this kind in Uzbekistan and is specifically focused on the digital transformation of the national railway operator. As previously reported by The Times of Central Asia, the EBRD has also provided a loan of up to €20 million to Uzbek pharmaceutical manufacturers Samarkand England Eco-Medical and Bayan Medical to expand production. To date, the EBRD has invested almost $6.9 billion (€6 billion) in Uzbekistan through 210 projects, with most of the funds supporting private entrepreneurship. Uzbekistan has been the largest recipient of EBRD funding in Central Asia for each of the past six years.

C5+1

U.S. Links Trusted Digital Infrastructure to Investment at C5+1 Conference

Stronger cybersecurity and trusted digital infrastructure could encourage greater U.S. investment in Central Asia, Mark Cameron said in Astana on September 29. Cameron, deputy assistant secretary in the State Department’s Bureau of South and Central Asian Affairs, was speaking at the C5+1 conference on artificial intelligence. He said data centers and trusted infrastructure would give American companies greater confidence to invest and expand their cooperation across the region. “The strongest house is built on the firmest foundation,” Cameron told reporters, linking cybersecurity to the development of advanced AI. Cameron said Washington sees private companies as central to the process, with government programs helping create conditions for investment and technological cooperation. “The United States has the deep belief that companies, given the opportunity, will find great solutions and new opportunities that many of us have never even considered before,” Cameron said. He said Washington has committed $5 million through CRDF Global for cybersecurity and digital-sector assistance. The support covers incident response, critical infrastructure protection, financial sector security, and cybersecurity policy. The C5+1 format brings together the United States and the five Central Asian countries. The conference comes ahead of Secretary of State Marco Rubio’s planned business delegation to Uzbekistan in mid-October, involving executives from more than 100 American companies alongside talks with the region’s foreign ministers. Kazakhstan Sets Out Its AI Development Model Kazakhstan’s vice minister of artificial intelligence and digital development, Bakhtiyar Mukhametkaliyev, described the development of an AI economy as a five-layer process. Energy comes first, followed by access to chips and graphics processing units (GPUs), information systems, high-quality data, and finally AI agents. Countries that attempt to deploy AI agents before building the infrastructure and data beneath them, Mukhametkaliyev said, are unlikely to realize their full economic value. He also framed data centers as a way for Kazakhstan to convert its energy and resource base into higher-value digital capacity. Mukhametkaliyev stressed that Kazakhstan does not intend to build its emerging AI ecosystem solely for the domestic market. He said the infrastructure should also help neighboring countries develop their AI industries and improve connectivity. He also pointed to drones, space technologies, startups, and workforce reskilling as areas where digitalization could create new markets and occupations. Kazakhstan’s ties with U.S. technology companies are also expanding. NVIDIA CEO Jensen Huang is scheduled to make his first visit to Kazakhstan on October 23, as the country develops data centers and NVIDIA-based computing infrastructure. Regional Plans for AI Development Kyrgyzstan focused on practical AI applications, human oversight, education, and local-language models. Niyazaly Bazarbaev, adviser to the minister of digital development and innovative technologies, said Kyrgyz and other Central Asian languages remain insufficiently represented in existing AI systems. He discussed work involving a Kyrgyz-language corpus of roughly five million words and efforts to prepare the school curriculum for an AI-driven economy. Tajikistan presented AI as a presidential priority. Hakim Ismoilzoda, first deputy director of the Agency for Innovation and Digital Technologies, highlighted Tajikistan’s initiatives at the United Nations on AI and its safe, secure,...

Cybersecurity

Uzbekistan’s Cerberus Wins Road to TechCrunch Regional Final

Uzbek startup Cerberus has won the regional final of Road to TechCrunch Startup Battlefield 2026, earning a ticket to San Francisco. For Uzbekistan’s young technology industry, the result is another sign of its push beyond the domestic market. For Cerberus, the challenge is now to convince international investors and clients that an AI tool developed in Tashkent to find vulnerabilities can compete in the global cybersecurity market. Cerberus took first place in the regional final on August 12. WeGlobal AI finished second, followed by LOOQ. Twenty-two startups reached the final after being selected from 726 applications from 39 countries. Uzbekistan was represented by six projects. The three winners will represent Central Eurasia at Startup Battlefield 200 in San Francisco. TechCrunch Disrupt 2026 will run from October 13 to 15. Twenty of the 200 companies will be selected to pitch on the main stage, with five advancing to the final round to compete for the $100,000 equity-free grand prize and the Disrupt Cup. The three regional winners will share a $100,000 investment pool, with Cerberus receiving $50,000. Competition rules state that each investment will be made on standard market terms in exchange for equity. Astana Hub Ventures and IT Park Ventures are providing the funding in partnership with Silkroad Innovation Hub. According to the organizers, the winners will also receive a combined $100,000 in OpenAI API credits. Cerberus founder and CEO Aziz Akhmedkhodjaev told The Times of Central Asia that two factors were behind the company’s success: the product and the team’s ability to explain the problem it solves. “I would say there are two main things here. The first, of course, is the product. Everyone understood that we had created something the market really needs,” he said. “I think that was the key to winning. I didn’t spend a single second of the pitch on anything other than clearly explaining the problem, how the solution works, and its potential.” Cerberus describes its product as an AI-powered cybersecurity system capable of finding vulnerabilities in corporate applications and IT infrastructure. Demand for such tools is growing alongside the spread of generative AI: companies and individual developers can write software faster, but the volume of code that needs to be checked for errors and potential attack vectors is also increasing. “Literally everyone is writing code with artificial intelligence now. Vulnerabilities, coding errors, and other weaknesses are appearing much faster,” Akhmedkhodjaev said. The company says Cerberus allows users to give its AI agent access to an application or IT infrastructure and task it with finding vulnerabilities. The agent can also test authentication and perform other security checks. According to Akhmedkhodjaev, however, using a general-purpose AI model for such work can itself create risks. “If you give Claude or another AI access to a vulnerability in a real bank, even the smallest mistake can lead to serious financial losses,” he said. The company says Cerberus is designed to restrict what its AI agent can do after identifying a weakness. “In our project, there is a...

Cybersecurity

Kazakhstan Examines Data Leak Claim Involving 15 Million People

A database allegedly containing the personal information of 15 million people in Kazakhstan has appeared on the dark web. The seller is asking 0.5 bitcoin, about $32,000, for a dataset containing tens of millions of records. The seller claims the information was obtained after hacking the government’s eGov portal. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development has not confirmed that account. Specialists are examining samples of the database and trying to determine where the data came from. The sale was reported by the Russian Telegram channel Mash. According to the channel, the file is about 2.7 GB and contains 47 million rows. Its description lists passport details, phone numbers, email addresses, places of employment, passwords, and scans of documents. The claim that the database contains information on 15 million people has not been independently confirmed. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development disputes the allegation that eGov was hacked. It said a preliminary review had found no evidence that government e-services were breached, and that officials were examining samples of the data to determine where they came from. The ministry has also questioned parts of the database description. For example, eGov does not store scanned copies of passports in the form described by the seller, while digital documents have a different structure. The allegation follows at least two other major cases involving personal data in the past 14 months. In June 2025, around 16 million records containing the names, individual identification numbers, addresses, and phone numbers of Kazakhstani citizens were found to be publicly accessible. The Health Ministry later said the dataset had been compiled from various sources, possibly including the information systems of medical organizations. It said any information originating from medical systems dated from before April 1, 2024. The Digital Ministry later reported that the investigation had found no signs of a direct hack. According to the ministry, much of the information had been extracted in 2022, possibly by someone with legitimate access to personal data or by a third party using credentials that had been shared or stolen. The investigation into that leak has still not been completed. In April 2026, the National Security Committee said the criminal case remained under investigation. The agency disclosed no further details, citing the confidentiality of the investigation. The allegation comes just two months after police seized another large database containing personal information on nearly 16 million Kazakhstanis from employees of a collection agency in the Zhetysu region. It is not known whether the two datasets are connected. Investigators must therefore establish whether the database offered for sale is authentic and how recent its contents are. The 2025 case showed how information from different sources and different years can be combined into a single database, meaning a large file offered for sale does not necessarily represent a new breach. There is reason to take such reports seriously. According to KZ-CERT data cited by research agency Finprom, Kazakhstan recorded 9,400 information security incidents in the first three months of 2026. Nearly...

Digital Fraud Prevention

Kazakhstan Introduces Mandatory Biometric ID for Mobile Phone Subscribers

Kazakhstan is implementing mandatory biometric identification for all new mobile phone subscribers as part of broader efforts to combat telephone and internet fraud, the Ministry of Artificial Intelligence and Digital Development has announced. The ministry noted that the country already enforces several measures to address SIM card misuse, including efforts to prevent fraud, illegal SIM registration, and the use of devices for mass calls and bulk messaging. From the start of 2026, these safeguards will be tightened further. Under the new regulations, SIM cards will only be issued after biometric identification is completed. Communication services will not be activated until the subscriber's identity is verified through facial scanning. The policy applies to both individuals and legal entities. “For businesses and organizations, this requirement also applies to employees issued SIM cards for work-related purposes. Biometric identification eliminates anonymous number usage and increases accountability,” the ministry stated. Authorities expect the measure to curb illegal SIM sales via dealers and intermediaries. Regardless of where a number is purchased, service activation will only occur once the end user’s identity is confirmed. Additionally, a cap has been introduced on the number of SIM cards that can be registered to a single individual: up to ten for personal and family use. Exceeding this limit requires documented justification and identification of the devices in which the extra SIMs will be used. “This approach reduces the risk of mass SIM registration, a hallmark of fraudulent operations,” the ministry added. A key component of the new anti-fraud framework is the expansion of collaboration between mobile operators and the Anti-Fraud Center of the National Bank of Kazakhstan. This cooperation is intended to ensure the swift identification and deactivation of numbers linked to criminal activity. “In the case of suspicious calls or SMS messages, including those made using SIM boxes, telecom operators will relay subscriber information to the National Bank's Anti-Fraud Center and launch an investigation. If fraud is confirmed, the number will be blocked immediately and telecom services suspended,” the ministry explained. As previously reported by The Times of Central Asia, Kazakhstan also intends to introduce joint liability for banks and mobile operators in cases of internet fraud perpetrated through their infrastructure.