Uzbekistan: personal data of 27 million citizens reportedly leaked to the darknet

Reports circulated on social media about a possible leak to the darknet of personal data of 27 million Uzbek citizens. The database may include names, phone numbers, PINFL, residential addresses, passport details and biometric photos. As an example, attackers cited the personal data of the minister of digital technologies. They said that if their demands were not met by 08:00 on 2 November, the data archive would be put up for open sale.

Blogger Umid Gafurov cited a programmer who found a critical vulnerability on a ministry platform in late September, scoring 8.6 out of 10 on the CVSS scale. Due to the flaw, any user could browse without authorisation or limits data of about 40 million people, including nearly the entire population of Uzbekistan. The developer's attempts to warn the ministry met obstacles. Officials said they knew about the error but did not consider it urgent.

Five days later the vulnerability remained open, so the specialist contacted the Cybersecurity Center of Uzbekistan. The fix came eight days later and was initially only partial. The developer estimated potential economic damage from illegal loans and other abuse at about $50 per person, or $2 billion nationwide, if the database fell into fraudsters' hands. Separately, authorities are checking reports of a possible leak of user data from the SAFE Service platform, formerly known as Safe Road.