Hackers Walk Back Claim of Uzbekistan Data Leak Affecting 27 Million
Journalists in Uzbekistan found their own personal information and details about relatives in a database circulating online, Gazeta.uz has reported. The Interior Ministry announced an investigation on October 29 after reports linked the records to SAFE Service, formerly known as SafeRoad, a digital service for motorists. As of November 5, the authorities had yet to announce their findings. Separately, on November 1, a hacker group known as Butterfly claimed it had accessed a government database containing personal information on more than 27 million Uzbek citizens. The group said it had accessed passport details, addresses, phone numbers, personal identification numbers (PINFL), and biometric photographs belonging to millions of people. To support its claims, the group published Digital Technologies Minister Sherzod Shermatov’s phone number and threatened to sell the database on the dark web, a part of the internet accessible through specialized software that is also used to trade stolen data. By November 3, Butterfly had recast itself as a community of “white-hat hackers,” cybersecurity specialists who identify vulnerabilities in computer systems so they can be fixed. The group’s members said they had not stolen government databases and had instead sought to highlight security weaknesses and the slow response of the agencies responsible. The group did not explain why it had initially threatened to sell the alleged database. It is also unclear whether Butterfly’s members had permission from the owners of the information systems, as is customary in authorized security testing. Shermatov commented on the situation on November 4. Without confirming reports of a data breach, the minister warned about vulnerabilities in outdated information systems. He said artificial intelligence was making software vulnerabilities easier to discover and urged government agencies and businesses to conduct more frequent security checks and heed warnings from UzCERT, Uzbekistan’s national computer incident response service. He did not say whether the authorities had verified Butterfly’s claims or established the origin of the alleged data. The Interior Ministry and the Cybersecurity Center under the State Security Service are investigating the origin of the records linked in October reports to SAFE Service. The developer, AUTODOC, denied that the records came from its application, saying the information had been collected from other sources before the application was launched. No connection between the two incidents has been established. Butterfly’s withdrawal of its initial claim and AUTODOC’s explanation do not establish where the published information originated. Cybersecurity specialist Akmal Sodikov notes that personal data can become accessible to unauthorized parties because of server misconfigurations, inadequate access controls, employee actions, or vulnerabilities in third-party services. Passport details, phone numbers, and PINFL numbers are valuable to fraudsters. With such information, criminals can more easily impersonate bank employees or government officials to trick people into disclosing verification codes and gain access to their accounts. In Uzbekistan, government services, digital identification, and financial transactions are becoming increasingly interconnected. As a result, protecting personal data depends on the security of multiple information systems. In February 2026, the country faced reports of an alleged leak affecting 15 million citizens....
