Information is circulating on social networks about a possible hack and leakage of personal data of 27 million citizens of Uzbekistan into the darknet. According to reports, the compromised database may contain information such as full names, phone numbers, TINs, residential addresses, passport details, and biometric photos. As an illustration, attackers published the personal information of the Minister of Digital Technologies.
The attackers stated that if their demands are not met by 08:00 on November 2, the archive with this data will be put up for open sale.
Against the backdrop of these reports, blogger Umid Gafurov shared the story of a programmer who discovered a serious vulnerability on the resource of one of the country's ministries at the end of September. This vulnerability was rated at 8.6 out of 10 on the CVSS scale. Due to this error, any user could access the data of approximately 40 million people without needing authorization or adhering to limits, covering almost the entire population of Uzbekistan and foreign citizens registered in the republic.
Confidential information such as full names, photos, dates of birth, as well as series and numbers of ID cards, foreign passports, and birth certificates, TINs, information about educational institutions, and registration addresses with cadastral numbers, became publicly available.
The developer's attempts to quickly notify the department were met with resistance. In the ministry's call center, he was told, 'Are you a hacker? Come to the office, I'll show you that everything is fine.' However, when the programmer managed to contact specialized specialists through another official channel and personally presented the problem at a meeting in the department, he was informed that the error was known but was not considered a priority, citing recent security checks.
Five days later, the vulnerability remained unpatched, and the specialist forwarded the information to the Cybersecurity Center of Uzbekistan as part of the responsible disclosure procedure. He noted that this center lacks a convenient online mechanism for anonymous appeals; applications are accepted via Telegram, by phone, or in person at the office. Furthermore, the department does not provide compensation for discovered errors, limiting itself to a letter of appreciation upon request, and does not guarantee timelines for fixing glitches, only sending official notifications to relevant structures.
The issue on the ministry's platform was fixed only eight days after contacting the Cybersecurity Center, and initially, the fix was only partial. The center's employees asked the programmer to independently confirm that the department had indeed closed access to the data, and also warned against public reporting of such incidents due to the imperfection of the legislative framework.
According to the developer's preliminary assessment, if the database containing information on 40 million people falls into the hands of fraudsters, the potential financial damage from illegal loan applications and other abuses could reach about $50 per person, totaling $2 billion across the country.
It should also be mentioned that reports are being considered in Uzbekistan regarding a possible leak of personal data of users of the SAFE Service platform, formerly known as Safe Road.