Threat actors claim to hold 27 million Uzbek citizens’ records and have set a sale deadline of 2 November, as a separate account reveals a critical ministry vulnerability affecting 40 million people went unpatched for nearly two weeks after officials dismissed the warning.