Listen to the article
A hacker group that claimed on November 1 to have seized personal records on more than 27 million Uzbek citizens reversed course two days later, saying it had not stolen any government database but had instead sought to expose security weaknesses — without explaining why it had initially threatened to sell the alleged data on the dark web.
The group, which calls itself Butterfly, said it had accessed passport details, home addresses, phone numbers, personal identification numbers (PINFL), and biometric photographs belonging to millions of people. To lend weight to the claim, it published the phone number of Digital Technologies Minister Sherzod Shermatov and threatened to put the database up for sale through dark-web channels. By November 3, Butterfly had recast itself as a community of “white-hat hackers” — specialists who probe systems for vulnerabilities so they can be fixed — and said its goal had been to draw attention to slow responses from the agencies responsible. It is unclear whether the group had authorisation from the owners of the relevant information systems, as is standard practice in legitimate security testing.
Shermatov addressed the situation on November 4 without confirming that a breach had occurred. He warned that outdated information systems carry real vulnerabilities, noted that artificial intelligence is making it easier to discover software flaws, and urged government agencies and businesses to conduct security checks more frequently and act on warnings from UzCERT, Uzbekistan’s national computer incident response service. He did not say whether the authorities had verified Butterfly’s claims or traced the origin of the alleged data.
A Separate Investigation Already Under Way
The Butterfly episode is distinct from an earlier incident that prompted the Interior Ministry to open an investigation on October 29. That inquiry concerns a database of personal records that circulated online and was linked in press reports to SAFE Service — a digital platform for motorists formerly known as SafeRoad. Journalists at Gazeta.uz reported finding their own personal details and information about relatives within the circulating records. The developer, AUTODOC, denied that the records originated from its application, saying the information had been gathered from other sources before the application was launched. As of November 5, neither the Interior Ministry nor the Cybersecurity Center under the State Security Service — both of which are investigating — had announced findings. No connection between the SAFE Service records and Butterfly’s claims has been established.
Cybersecurity specialist Akmal Sodikov notes that personal data can become accessible to unauthorised parties through server misconfigurations, inadequate access controls, employee actions, or vulnerabilities in third-party services. Passport details, phone numbers, and PINFL numbers are particularly valuable to fraudsters: armed with such information, criminals can more convincingly impersonate bank staff or government officials to trick people into surrendering verification codes and surrendering access to their accounts.
A Recurring Pattern
The two incidents arrive against a backdrop of growing concern about the security of Uzbekistan’s expanding digital infrastructure. Government services, digital identification systems, and financial transactions are increasingly interconnected, meaning that a weakness in any one system can expose data held across several others. In February 2026, reports emerged of an alleged leak affecting 15 million citizens; the authorities did not confirm that scale but acknowledged cyberattacks on systems at three government agencies, with preliminary estimates suggesting roughly 60,000 records may have been involved.
Butterfly’s withdrawal of its initial claim and AUTODOC’s denial of responsibility for the October records leave the origin of both datasets unresolved. The investigations remain open.