According to the F6 report for the period 2025–2026, Uzbekistan recorded approximately 15 million compromised data records obtained from leaks of corporate and government databases. This figure places Uzbekistan third in Central Asia in terms of leak volume, behind Tajikistan and Kazakhstan.
Globally, the cybersecurity firm F6 discovered over 600 million compromised user records across 164 database leak publications. Of these, 91 databases were freely posted on hacker forums and Telegram channels, while 73 were offered for sale.
Central Asian countries collectively accounted for 257 million compromised records, which is more than a third of the total global volume. Tajikistan leads the region with the highest number of leaks—approximately 217 million records, accounting for 84 percent of the total in Central Asia, mainly due to a major incident in the public sector.
Kazakhstan ranked second with approximately 25 million records (10 percent), while Uzbekistan registered 15 million records, corresponding to 6 percent of the regional volume.
The distribution by the number of leak publications differed from the distribution by the total volume of records. Kazakhstan led the region by publishing 57 percent of all leak reports, followed by Uzbekistan with 29 percent, and Tajikistan with 14 percent.
By industry, the compromised records in Central Asia overwhelmingly (96 percent) belong to the public sector, driven by a major hack in Tajikistan. The second most significant sector is education, which accounted for 3 percent of compromised records, with most of this figure related to platform breaches in Kazakhstan, involving 8.5 million records.
Regarding publication frequency, the public sector provided 43 percent of all leak reports, surpassing education (29 percent) and the financial sector (28 percent).
Lada Kryukova, Head of Research and Monitoring at F6, noted that while a single large leak can skew regional statistics, regular small breaches pose equal risks to citizens and businesses. The cybersecurity company advised organizations to strengthen data protection, conduct security assessments, monitor compromised credentials, and implement incident response plans to mitigate the consequences of hacks.