Listen to the article
Threat actors claiming to hold the personal data of 27 million Uzbek citizens have warned they will put the archive on open sale unless unspecified demands are met — a deadline they set for 08:00 on 2 November. As proof of access, they published the personal details of the Minister of Digital Technologies. The threatened release would include full names, phone numbers, personal identification numbers (PINFL), home addresses, passport data and biometric photographs.
The claim surfaced on social media and coincides with a separate, detailed account of a critical security flaw that a programmer discovered on the platform of an unnamed Uzbek ministry in late September. The vulnerability carried a CVSS severity score of 8.6 out of 10. According to the account, shared publicly by blogger Umid Ghafurov, the flaw allowed any user to enumerate records on roughly 40 million people — effectively the entire registered population of Uzbekistan plus foreign nationals — without authentication and without any rate limiting. Exposed fields included full names, photographs, dates of birth, ID-card and foreign-passport series and numbers, birth certificate details, PINFLs, educational enrolment information, registered addresses and cadastral numbers.
A Ministry That Did Not Want to Hear It
The programmer’s attempts to alert the ministry ran into immediate resistance. A call-centre operator reportedly responded: “Are you some kind of hacker? Come to the office and I’ll show you everything is fine.” When the researcher managed to reach technical staff through a separate official channel and explained the problem in person at the ministry, officials told him they were already aware of the flaw but did not regard it as urgent, citing security audits that had recently been completed.
Five days after the initial report the vulnerability remained open. The programmer then filed a responsible-disclosure report with Uzbekistan’s Cybersecurity Centre. He noted that the centre has no convenient anonymous online submission mechanism; reports are accepted only via Telegram, by telephone or in person at its offices. The centre does not pay bug bounties, offering only a letter of thanks on request, and it sets no guaranteed remediation deadlines, instead forwarding official notifications to the responsible agency.
The flaw on the ministry platform was closed only eight days after the Cybersecurity Centre was notified — and even then only partially at first. Centre staff asked the programmer himself to verify whether the ministry had actually restricted access to the data. They also warned him that publicly disclosing such incidents is prohibited under current law, which they described as not yet ready to handle such cases.
A Potential $2 Billion Exposure
The programmer estimated that if a database of 40 million records fell into the hands of fraudsters, the potential economic damage from illegal loan applications and other identity-based abuses could reach roughly $50 per person — approximately $2 billion at national scale.
The episode adds to growing concern about the security of state-held personal data in Uzbekistan. Authorities are separately investigating reports of a possible data leak from the SAFE Service platform, formerly known as Safe Road, which stores vehicle and road-safety records. No official statement on either the darknet threat or the ministry vulnerability had been issued at the time the details became public.