Cybersecurity - The Times Of Central Asia

Viewing results 1 - 6 of 6

Cybersecurity

Uzbekistan’s Cerberus Wins Road to TechCrunch Regional Final

Uzbek startup Cerberus has won the regional final of Road to TechCrunch Startup Battlefield 2026, earning a ticket to San Francisco. For Uzbekistan’s young technology industry, the result is another sign of its push beyond the domestic market. For Cerberus, the challenge is now to convince international investors and clients that an AI tool developed in Tashkent to find vulnerabilities can compete in the global cybersecurity market. Cerberus took first place in the regional final on August 12. WeGlobal AI finished second, followed by LOOQ. Twenty-two startups reached the final after being selected from 726 applications from 39 countries. Uzbekistan was represented by six projects. The three winners will represent Central Eurasia at Startup Battlefield 200 in San Francisco. TechCrunch Disrupt 2026 will run from October 13 to 15. Twenty of the 200 companies will be selected to pitch on the main stage, with five advancing to the final round to compete for the $100,000 equity-free grand prize and the Disrupt Cup. The three regional winners will share a $100,000 investment pool, with Cerberus receiving $50,000. Competition rules state that each investment will be made on standard market terms in exchange for equity. Astana Hub Ventures and IT Park Ventures are providing the funding in partnership with Silkroad Innovation Hub. According to the organizers, the winners will also receive a combined $100,000 in OpenAI API credits. Cerberus founder and CEO Aziz Akhmedkhodjaev told The Times of Central Asia that two factors were behind the company’s success: the product and the team’s ability to explain the problem it solves. “I would say there are two main things here. The first, of course, is the product. Everyone understood that we had created something the market really needs,” he said. “I think that was the key to winning. I didn’t spend a single second of the pitch on anything other than clearly explaining the problem, how the solution works, and its potential.” Cerberus describes its product as an AI-powered cybersecurity system capable of finding vulnerabilities in corporate applications and IT infrastructure. Demand for such tools is growing alongside the spread of generative AI: companies and individual developers can write software faster, but the volume of code that needs to be checked for errors and potential attack vectors is also increasing. “Literally everyone is writing code with artificial intelligence now. Vulnerabilities, coding errors, and other weaknesses are appearing much faster,” Akhmedkhodjaev said. The company says Cerberus allows users to give its AI agent access to an application or IT infrastructure and task it with finding vulnerabilities. The agent can also test authentication and perform other security checks. According to Akhmedkhodjaev, however, using a general-purpose AI model for such work can itself create risks. “If you give Claude or another AI access to a vulnerability in a real bank, even the smallest mistake can lead to serious financial losses,” he said. The company says Cerberus is designed to restrict what its AI agent can do after identifying a weakness. “In our project, there is a...

Cybersecurity

Kazakhstan Examines Data Leak Claim Involving 15 Million People

A database allegedly containing the personal information of 15 million people in Kazakhstan has appeared on the dark web. The seller is asking 0.5 bitcoin, about $32,000, for a dataset containing tens of millions of records. The seller claims the information was obtained after hacking the government’s eGov portal. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development has not confirmed that account. Specialists are examining samples of the database and trying to determine where the data came from. The sale was reported by the Russian Telegram channel Mash. According to the channel, the file is about 2.7 GB and contains 47 million rows. Its description lists passport details, phone numbers, email addresses, places of employment, passwords, and scans of documents. The claim that the database contains information on 15 million people has not been independently confirmed. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development disputes the allegation that eGov was hacked. It said a preliminary review had found no evidence that government e-services were breached, and that officials were examining samples of the data to determine where they came from. The ministry has also questioned parts of the database description. For example, eGov does not store scanned copies of passports in the form described by the seller, while digital documents have a different structure. The allegation follows at least two other major cases involving personal data in the past 14 months. In June 2025, around 16 million records containing the names, individual identification numbers, addresses, and phone numbers of Kazakhstani citizens were found to be publicly accessible. The Health Ministry later said the dataset had been compiled from various sources, possibly including the information systems of medical organizations. It said any information originating from medical systems dated from before April 1, 2024. The Digital Ministry later reported that the investigation had found no signs of a direct hack. According to the ministry, much of the information had been extracted in 2022, possibly by someone with legitimate access to personal data or by a third party using credentials that had been shared or stolen. The investigation into that leak has still not been completed. In April 2026, the National Security Committee said the criminal case remained under investigation. The agency disclosed no further details, citing the confidentiality of the investigation. The allegation comes just two months after police seized another large database containing personal information on nearly 16 million Kazakhstanis from employees of a collection agency in the Zhetysu region. It is not known whether the two datasets are connected. Investigators must therefore establish whether the database offered for sale is authentic and how recent its contents are. The 2025 case showed how information from different sources and different years can be combined into a single database, meaning a large file offered for sale does not necessarily represent a new breach. There is reason to take such reports seriously. According to KZ-CERT data cited by research agency Finprom, Kazakhstan recorded 9,400 information security incidents in the first three months of 2026. Nearly...

Kazakhstan Introduces Mandatory Biometric ID for Mobile Phone Subscribers

Kazakhstan is implementing mandatory biometric identification for all new mobile phone subscribers as part of broader efforts to combat telephone and internet fraud, the Ministry of Artificial Intelligence and Digital Development has announced. The ministry noted that the country already enforces several measures to address SIM card misuse, including efforts to prevent fraud, illegal SIM registration, and the use of devices for mass calls and bulk messaging. From the start of 2026, these safeguards will be tightened further. Under the new regulations, SIM cards will only be issued after biometric identification is completed. Communication services will not be activated until the subscriber's identity is verified through facial scanning. The policy applies to both individuals and legal entities. “For businesses and organizations, this requirement also applies to employees issued SIM cards for work-related purposes. Biometric identification eliminates anonymous number usage and increases accountability,” the ministry stated. Authorities expect the measure to curb illegal SIM sales via dealers and intermediaries. Regardless of where a number is purchased, service activation will only occur once the end user’s identity is confirmed. Additionally, a cap has been introduced on the number of SIM cards that can be registered to a single individual: up to ten for personal and family use. Exceeding this limit requires documented justification and identification of the devices in which the extra SIMs will be used. “This approach reduces the risk of mass SIM registration, a hallmark of fraudulent operations,” the ministry added. A key component of the new anti-fraud framework is the expansion of collaboration between mobile operators and the Anti-Fraud Center of the National Bank of Kazakhstan. This cooperation is intended to ensure the swift identification and deactivation of numbers linked to criminal activity. “In the case of suspicious calls or SMS messages, including those made using SIM boxes, telecom operators will relay subscriber information to the National Bank's Anti-Fraud Center and launch an investigation. If fraud is confirmed, the number will be blocked immediately and telecom services suspended,” the ministry explained. As previously reported by The Times of Central Asia, Kazakhstan also intends to introduce joint liability for banks and mobile operators in cases of internet fraud perpetrated through their infrastructure.

Digitalization

Face Pay, Palm Scans, and AI Cameras: Inside Kazakhstan’s Digital Transformation

Daily life in Almaty, Kazakhstan’s largest city, increasingly resembles scenes from a futuristic film. Subway fares can be paid with a glance, schoolchildren enter campuses by scanning their palms, and traffic flows are monitored by an expansive video surveillance system. With just a smartphone, citizens can apply for a marriage license, open a business, or access official documents within seconds. Kazakhstan has embraced rapid digitalization, positioning itself as a regional leader in GovTech and fintech. Authorities promote this trajectory as a means to create a secure and efficient environment, and the public has largely welcomed it. The country now boasts one of the world’s highest penetration rates for cashless payments and digital services. Yet the swift adoption of emerging technologies has brought new challenges. The digital infrastructure is evolving faster than the country’s legal frameworks can adapt, raising concerns among experts about how to balance technological convenience, public safety, and the right to privacy. Biometric Security or Overreach? Kazakhstan’s biometric systems are being integrated into a growing ecosystem of everyday services. A prominent example is the Alaqan system in schools, which replaces traditional entry cards with palm-scanning technology. Currently in a pilot phase at nearly 300 schools, the government plans to expand the system nationwide within the next two to three years, should it prove to be successful. Supporters argue this enhances child safety by preventing unauthorized access. Critics, however, warn that it also involves building a vast biometric database of minors, requiring unprecedented security protocols. Simultaneously, the Ministry of Digital Development is rolling out a national video surveillance network powered by artificial intelligence. The system, which integrates citywide cameras into a unified platform, will enable real-time facial and license plate recognition and detect incidents such as fights, large gatherings, or abandoned items. Minister of Artificial Intelligence and Digital Development Zhaslan Madiyev described the system as a tool to monitor public safety 24/7. Equipment Dependence and Strategic Risk Much of Kazakhstan’s surveillance infrastructure relies on equipment from major Chinese companies such as Hikvision and Dahua. Their products are favored for their cost-effectiveness, but concerns have been raised internationally over cybersecurity vulnerabilities and potential data access “backdoors.” Several U.S. and EU countries have imposed restrictions on these firms for national security reasons. In Kazakhstan, which pursues a multi-vector foreign policy, the issue is viewed more as technical than political. Experts recommend diversifying suppliers and enforcing strict data encryption protocols, regardless of the origin of the equipment. Kazakhstan’s exposure to cybersecurity risks became clear in February 2024, when a leak involving the Chinese firm iSoon compromised databases belonging to local telecom operators and targeted government institutions, including the Unified Pension Fund. The incident prompted an urgent reassessment of data security practices. Centralized data hubs, experts noted, can only function securely if accompanied by significant investment in cybersecurity infrastructure. Legislation Lagging Behind While Kazakhstan has a law on personal data, experts argue it is outdated, particularly given the rapid integration of artificial intelligence into public systems. Recent legislative amendments now allow biometric identification to...

Cyberattacks

Cyberattacks Double in Kazakhstan in Early 2025

Kazakhstan experienced a sharp increase in cyberattacks during the first quarter of 2025, with 30,000 information security incidents recorded between January and May, double the number reported during the same period in 2024. According to data from research agency Ranking.kz, the most significant growth was observed in botnet-related activity, including spam mailings, password cracking, and remote system intrusions that cause service disruptions. Such incidents surged to 17,600 in the first quarter of 2025, compared to just 1,700 a year earlier. Conversely, attacks involving computer viruses, worms, and Trojans declined by 17.9% year-on-year, totaling 7,900 cases. However, phishing attempts targeting Kazakhstani users rose by 37.2%, reaching 2,000 reported incidents. Other categories saw a decrease. Cases involving inaccessibility of internet resources dropped by 48.1% to 112, while distributed denial-of-service (DDoS) attacks fell to 23, down from 30 in the same period last year. Incidents of unauthorized access or modification of digital content also declined slightly, with nine reported cases versus 13 previously. Despite the rise in cyber threats, Kazakhstan’s IT sector continues to demonstrate robust growth. In 2024, the value of services in computer programming, consulting, and related fields reached 1.5 trillion tenge (approximately $2.9 billion), a 36.3% increase compared to 2023. Since 2016, the volume of services in this sector has expanded more than tenfold, and by over fivefold since 2019. Regionally, Almaty and Astana dominated the sector, accounting for 90.2% of all IT services provided. Almaty led with KZT 853.1 billion ($1.6 billion), followed by Astana with KZT 486.7 billion ($950 million). The lowest activity was recorded in the Ulytau region, with only KZT 712.3 million ($1.3 million) in services. Separately, The Times of Central Asia previously reported that a Chinese firm involved in cyber intelligence operations had been active in Kazakhstan for several years, accessing telecom data over an extended period.

Kyrgyz Bank Launches Loan Self-Limitation to Fight Fraud and Boost Cybersecurity

For the first time in Kyrgyzstan’s financial market, a state-owned bank has introduced a self-limitation service on loans, aiming to strengthen cybersecurity and protect citizens from financial fraud. A New Step Toward Cybersecurity According to the Union of Banks of Kyrgyzstan, Eldik Bank, a state-owned institution, has launched a digital self-limitation service for its clients. The bank believes the mechanism could significantly enhance cybersecurity across the entire banking sector, especially if commercial and other state banks adopt the initiative as well. Earlier, the National Bank of the Kyrgyz Republic (NBKR) had started examining international experiences regarding self-prohibition of online loans and the feasibility of implementing such a practice domestically. The NBKR notes that a self-ban mechanism could not only shield customers from fraud but also encourage more informed decision-making when applying for loans. The Union of Banks of Kyrgyzstan has called on the wider banking community to collaborate on this initiative, advocating for a shared database of clients who have opted to limit their access to new loans. Learning from Regional Experiences In an interview with The Times of Central Asia, Anvar Abdraev, President of the Union of Banks of Kyrgyzstan, explained that the move was motivated largely by a global rise in banking fraud. “Russia and Kazakhstan have already introduced such a service in their banks. Statistics in these countries show that a large number of financially literate people use this service, probably because of the recent increase in bank fraud around the world,” Abdraev said. He added that promoting financial literacy and offering additional protective mechanisms is becoming a crucial component of banking policy across the region. Legislative Efforts Underway The mechanism is currently being actively promoted within Kyrgyzstan’s parliament. A draft bill to formalize the introduction of self-limitation on loans has been submitted for public discussion. “The Union of Banks is also participating in the discussions and is part of the working group drafting the legislation,” Abdraev said. “We aim to create a comprehensive digital platform where, alongside self-limitation, additional customer protection mechanisms would be operational.”