Personal Data - The Times Of Central Asia

Viewing results 1 - 6 of 10

Cyber Security

Kazakhstan Confronts Major Data Leak in High-Stakes Security Crackdown

A detective thriller worthy of a Hollywood script is quietly playing out in the daily lives of Kazakhstani citizens, one with implications for nearly every household. At its core lies the largest leak of personal data in Kazakhstan’s history, unfolding across Almaty and Astana. The incident touches on something deeply personal: data that could be weaponized by fraudsters for illicit gain. Sixteen Million Records Exposed In early June, the Telegram channel SecuriXy.kz, known for its cybersecurity reporting, revealed a massive breach of Kazakh citizens' personal data. "A CSV file containing the personal data of Kazakh citizens, containing 16.3 million lines, has been discovered. The table contains the following fields: Last name, First name, Middle name, Gender, Date of birth, ID number, IIN [Bank Identification Number], Mobile phone number, Work phone number, Home phone number, Citizenship, Nationality, Address, Confirmed address, Start and end dates of residence," the channel stated. The analysis identified 16,302,107 records, 16.9 million unique phone numbers, and 15,851,699 unique individual identification numbers (IINs), the number of citizens whose information had been compromised. “The ‘address’ field often contains the addresses of dental clinics, polyclinics, the Tax Committee, universities, and other organizations,” the channel noted. The leak included highly sensitive personal data such as contact details and IINs, which the channel warned could be used for: “Phishing, social engineering, document forgery, and telephone fraud.” The data appears to have been compiled over a significant period. SecuriXy.kz reported that, “Most of the records were entered into the system after 2011,” with over two million added in 2022 alone. Data from 2023-2024 also appears, underscoring the leak's relevance. The revelation sparked swift reactions from officials. The Ministry of Digital Development, Innovation, and Aerospace Industry (MCIAI) released a statement confirming an investigation in collaboration with law enforcement and intelligence agencies. “It should be noted that the initial analysis indicates that the information may have originated from private information systems. No hacker attacks or leaks of personal data from state information systems have been recorded at this time. It is premature to draw final conclusions or confirm the accuracy of the information until the investigation is complete,” the ministry stated, adding that similar past incidents often involved outdated data compiled by service sector firms or microfinance institutions. “The ministry is monitoring the situation," the authorities concluded. "Additional information will be posted after the investigation is complete.” Cybersecurity experts, however, were less dismissive. Enlik Satieva, vice president of the TSARKA Group, a cybersecurity firm affiliated with the government, stressed the seriousness of the breach. "These are not just names," she stated. "The published database contains the most important personal data of citizens. In particular, it includes surnames, first names, patronymics, gender, dates of birth, IINs, citizenship, nationality, residential addresses, registration and residence periods, as well as mobile, home, and work phone numbers." Satieva suggested that some of the data may have been sourced from medical organizations, and that the leak might stem from a specific entity or multiple sources linked through IINs. Criminal Case and Contradictions...

Anti-fraud

Kazakhstan to Hold Banks and Mobile Operators Liable for Online Fraud Losses

Kazakhstan will introduce joint liability for banks and mobile operators in cases of internet fraud involving their infrastructure, President Kassym-Jomart Tokayev announced during an extended meeting of the country’s law enforcement agencies. Addressing the growing threat of cybercrime, Tokayev emphasized the importance of prevention, noting that many internet and phone scams originate from well-organized criminal networks operating abroad, complicating investigation and prosecution. “Preventive measures are therefore crucial. Last year, a modern anti-fraud center was established at the National Bank of Kazakhstan to detect and block suspicious transactions,” Tokayev said. “We are now introducing joint liability for banks and mobile operators in fraud cases involving their infrastructure.” Tokayev also raised concerns over citizens' involvement in money laundering schemes. “Fraudsters lure people into laundering operations by offering rewards for access to their bank accounts. Many comply without considering the severe legal consequences,” he noted. A major enabler of these crimes is the widespread use of SIM cards registered under false identities. According to the president, nearly 100,000 such cases have been detected so far in 2025. The National Bank reported that since July 2024, the anti-fraud center has frozen over 63,000 suspicious transactions worth 2.5 billion tenge (approximately $4.83 million). Common schemes include telephone scams (22%), fake investment platforms (19%), and misuse of so-called “dropper” cards (19%).Continue reading

Cyber Security

Personal Data of 16 Million Kazakh Citizens Leaked

Kazakhstan has experienced one of the most extensive personal data breaches in its history. According to Olzhas Satiev, President of the Center for Analysis and Investigation of Cyber Attacks (CARKA), over 16.3 million records, representing nearly the entire population, have been made publicly accessible. Scope of the Breach The compromised data includes surnames, first names, patronymics, gender, date of birth, individual identification numbers (IIN), addresses, phone numbers, citizenship, ethnicity, and other sensitive details. The source of the leak has not been identified. Experts suggest it may be a compilation of previously hacked databases redistributed via closed Telegram channels. Alternatively, it could stem from a new, as yet undetected breach. “This is one of the largest leaks. An investigation is currently underway. We are awaiting information from the technical service of the National Security Committee (KNB),” said Satiev. Government Response and Ongoing Investigation The Ministry of Digital Development, Innovation and Aerospace Industry (MCIA) stated that it is closely monitoring the incident. The ministry’s Information Security Committee, in cooperation with law enforcement and intelligence agencies, is analyzing the leaked data and verifying its relevance. Initial assessments suggest the breach likely originated from private information systems. The MCIA emphasized that no cyberattacks on government databases have been detected. “It is premature to draw final conclusions or confirm the accuracy of the leaked information until the investigation concludes,” the ministry said. Individuals affected by the leak will be notified through the e-government portal. The ministry also noted that previous leaks involved outdated information sourced from microfinance organizations and other commercial entities. Combating the Shadow Data Market Separately, the Ministry of Internal Affairs recently dismantled an organized group involved in the illegal sale of personal data. Authorities say the group accessed state databases and distributed information through Telegram channels, often in cooperation with debt collection agencies. More than 140 individuals, including channel administrators and company executives, were detained. Five suspects remain in custody. Investigators seized over 400 pieces of computer and electronic equipment. “The information was obtained from state databases and distributed through Telegram channels. Work is ongoing to identify all parties involved,” said Zhandos Suinbay, head of the Interior Ministry’s cybercrime division. Criminal proceedings have been launched under Articles 205 (unlawful access to information), 147 (violation of privacy), and 211 (distribution of restricted data) of the Criminal Code of Kazakhstan. The Interior Ministry vowed to intensify efforts to prevent further data breaches and urged citizens to be cautious, particularly when sharing personal information or using unsecured digital platforms.

Uzbekistan Moves to Regulate AI and Protect Personal Data

Uzbekistan's Legislative Chamber of the Oliy Majlis (Parliament) has approved a new bill in its first reading that seeks to regulate the use of artificial intelligence, and introduce legal accountability for the misuse of personal data involving AI technologies. The bill was reviewed during a parliamentary session on April 15 and is designed to safeguard personal privacy in the face of rapidly advancing AI capabilities. It proposes penalties for the unauthorized processing and dissemination of personal data, particularly through online platforms and the media, when artificial intelligence is involved. Balancing Innovation and Risk Lawmakers noted that global investment in AI reached $154 billion in 2023 and was expected to double in 2024, with projections of a tenfold increase by 2030. Uzbekistan is actively working to integrate AI across various sectors, including industry, public administration, crime prevention, and environmental management. However, the government has also raised alarms about the risks posed by unregulated AI use. In particular, concerns have grown over privacy violations stemming from deepfake content and manipulated media. In 2024 alone, incidents involving fake AI-generated images and videos of public figures increased fiftyfold. The number of reported cases involving illegal use of AI-generated content rose from 1,129 in 2023 to 3,553 in 2024. Key Provisions of the Bill The proposed legislation formally defines “artificial intelligence” and sets out the government’s policy approach toward its development and application. It includes requirements for labeling AI-generated content and bans uses of AI that could undermine human dignity, personal freedoms, health, or individual rights. If adopted into law, the bill would mark a significant step toward establishing ethical and legal norms for AI deployment in Uzbekistan, amid growing global concern over the unchecked use of emerging technologies.