A hacker group calling itself Butterfly says it took a full copy of a restricted database from Uzbekistan's former Personalisation Agency. That database holds identity records on more than 27 million people, which is about two-thirds of the country's population of almost 40 million. Zamin.uz reports the group's exact figure as 27,174,051 records, and FinTech & Retail Eurasia rounds it to 27.17 million. As proof, the group published personal details of Digital Technologies Minister Sherzod Shermatov and threatened to sell the archive unless officials contacted it by 08:00 Tashkent time on 2 November. No one has independently confirmed the breach. The Uzbek government has neither confirmed nor denied it. Since then, UzDaily reports that Butterfly has denied carrying out a breach at all and now calls its earlier posts a "warning". Accounts of what actually happened therefore conflict, and readers should treat the 27 million figure as a claim, not an established fact.
What Happened
Zamin.uz reports that the claim first appeared on 1 November on a darknet .onion page with a countdown timer. AKIpress and the Uzbek outlet Aniq.uz say it was also spread on social media. According to Eurasianet, the Uzbek outlet Podrobno.uz broke the story, while several major government-aligned outlets stayed silent at first. In an English-language message quoted by Eurasianet, Butterfly said that "after more than a year of persistent work" it had obtained "a complete copy of a restricted internal database belonging to the Personalization Agency under the Ministry of Justice." It demanded that authorities "destroy the data on our terms, or the archive goes to the highest bidder." The group said it had sent specific instructions to officials through a "private channel". Zamin.uz describes the deadline as a 48-hour ultimatum. Other outlets give the cut-off as the morning of 2 November.
Officials have said little. Vaqt.uz, as cited by Kazakhstan's FBRK, reports that Ministry of Digital Technologies press secretary Sherzod Akhmadov said checking such reports is the job of the Cybersecurity Centre under the State Security Service. Journalists asked the Centre for comment and got no official response. Aniq.uz reports that no responsible agency has commented, and that it is still unknown whether the data was put up for sale after the deadline.
The story then shifted. UzDaily reports that Butterfly put out a second statement calling itself a community of ethical hackers with no destructive intent. In that statement the group denied breaching the 27-million-record database. It said it had found several critical vulnerabilities and data leaks in government platforms, including infrastructure once run by the Personalisation Agency, and accused authorities of neglecting security. It said the minister's details were already public and could be found with open-source intelligence (OSINT) techniques. The group also said it plans to publish vulnerability findings regularly and to recruit new members.
Two outlets point out a mismatch in the target's name. FBRK and UzDaily both say the Personalisation Agency no longer exists in the form Butterfly named. Since January 2026, its functions have been reorganised and moved under the Ministry of Internal Affairs. Butterfly's reference to an agency "under the Ministry of Justice" is therefore out of date. That could mean the group took the data some time ago, or that it got the agency's current status wrong.
What Was Taken
Butterfly listed the following fields as being in the dataset. Zamin.uz, FBRK and Uzbekistan Observer report them consistently:
- Full names and dates of birth
- PINFL (Uzbekistan's personal identification number) and passport series and numbers
- Registered home addresses and phone numbers
- Biometric photographs
Eurasianet also reports that passwords were included. No other outlet repeats that claim, and the group's own field list does not mention passwords. Eurasianet says the affected records may cover foreign residents as well as Uzbek nationals.
The only data actually released is the record for Minister Shermatov. Zamin.uz reports it contained his full name, date of birth, PINFL and phone number. Butterfly now says this record came from public sources. If that is true, the sample does not prove access to the database. Every outlet that has examined the claim, including UzDaily, FBRK and Eurasianet, says nobody has confirmed that the full database was taken.
Why It Matters
Whether or not Butterfly took this particular archive, three reports from the same weeks point to real weaknesses in Uzbekistan's government data systems:
- A separate unauthenticated exposure of about 40 million records. Uzbekistan Observer reports a detailed account, shared publicly by blogger Umid Ghafurov, of a flaw a programmer found in late September on an unnamed ministry's platform. It was rated CVSS 8.6. According to that account, anyone could enumerate records on roughly 40 million people without logging in and without rate limits. Exposed fields reportedly included names, photographs, dates of birth, ID card and foreign passport numbers, birth certificate details, PINFLs, school and university enrolment information, addresses and cadastral (land registry) numbers. The ministry reportedly brushed off the report. A call-centre operator asked whether the researcher was "some kind of hacker". Technical staff said they already knew about the flaw but did not consider it urgent because recent audits had been completed. Five days later the flaw was still open, and the researcher reported it to the Cybersecurity Centre. Nobody has publicly linked this flaw to Butterfly. However, it matches the vulnerability-based story Butterfly now tells.
- The SAFE Service incident. Eurasianet reports that on 29 October the Ministry of Internal Affairs announced it was investigating a suspected breach of SAFE Service, formerly Safe Road, a platform for paying for vehicle registration, fines and insurance. FinTech & Retail Eurasia reports that data said to be circulating included vehicle owners' document details, PINFLs and photos. It says SAFE Service denied on 29 October that its platform was the source, and that the ministry and the Cybersecurity Centre were looking into it.
- Telegram account hijacking. Eurasianet also reports a recent wave of attacks on Uzbek Telegram channels. Attackers used hijacked accounts to send links that steal readers' account access. This may or may not be related.
For defenders, the important point is that the data Butterfly listed is permanent identity data. PINFLs, passport numbers, dates of birth and face photos cannot be changed the way a password can. If this data is exposed, it supports identity fraud, SIM-swap fraud, fake loan applications and attempts to defeat remote identity checks at banks and fintech firms for years afterwards.
The Attack Technique
No one has confirmed how Butterfly got access, or whether it did. The group's first claim described more than a year of persistent effort, which suggests patient, repeated attempts against the agency's systems. Its later statement describes something else: finding vulnerabilities and data leaks in government web platforms, with no claim of a full database theft. The 40-million-record enumeration flaw reported by Uzbekistan Observer shows the kind of weakness that would make either story possible. That kind of weakness is an API or web endpoint that returns citizen records without authentication or rate limiting, so anyone can pull them in bulk by stepping through ID numbers. The Shermatov sample tells us little either way, since Butterfly itself says those details could be found through OSINT.
The extortion approach was a deadline, a countdown timer, a threatened auction and private contact with officials. That is standard data-theft extortion, whatever the group now says about its ethical intentions.
What Organizations Should Do
- Assume Uzbek identity data is already compromised. Banks, telecoms, fintechs and marketplaces serving Uzbek customers should not treat PINFL, passport number, date of birth or a matching photo as proof of identity on their own. Require possession factors such as device binding or app-based confirmation, and liveness checks, for account opening, SIM replacement and credit decisions.
- Test public APIs for enumeration. Look for endpoints that return personal records in response to sequential or guessable IDs. Enforce authentication, object-level authorisation and rate limits, and alert on high-volume lookups from a single client.
- Set up a working vulnerability disclosure route. Publish a disclosure contact and train front-line and call-centre staff to pass security reports to technical teams. A finished audit is not a reason to leave a reported flaw open.
- Watch for account takeover and phishing. Expect phishing that uses this news as a lure, along with more Telegram account hijacking. Turn on Telegram two-step verification and passcodes, and warn staff and customers not to click unexpected links from known contacts.
- Track the data. Monitor darknet markets and leak channels for listings matching Butterfly's field set, and check any samples against your own customer records before taking action.
- Review records inherited in reorganisations. When a government body's functions move to another ministry, as with the Personalisation Agency this year, check who now owns the old systems, who still has access to them, and whether they are still patched.
Sources: Hacker group claims data breach of over 27 million Uzbek citizens -... | BUTTERFLY claims to have found flaws in Uzbekistan's state systems | Uzbekistan reportedly experiencing multiple hacker attacks Eurasianet | Hackers BUTTERFLY claim to have obtained data on 27 million residen... | Возможная утечка данных 27 млн узбекистанцев: что известно о заявле... | Are the data of 27 million Uzbeks at risk? A sensational ultimatum... | Хакерлар 27 миллиондан ортиқ ўзбекистонликнинг шахсий маълумотлари... | Darknet Threat Targets 27 Million Uzbek Records After Ministry Igno...