Links to resources, including those on the dark web, have appeared on the Reddit platform, where, according to reports, data from the state information systems of Uzbekistan has been posted. Gazeta.uz reports that the data may include information about 15 million citizens.
The State Unitary Enterprise "Cybersecurity Center" commented on the situation, noting that an investigation is currently underway regarding this incident.
“Rumors are circulating on social media that there has been a leak of personal data of citizens of Uzbekistan from some state information systems. An analysis is currently being conducted, and additional information will be provided later,” the center stated.
On one of the forums, where hacker attacks and the sale of stolen data are usually discussed, it is claimed that the OAuth server, which is a key element of the state authentication system, was hacked. This created a threat to all websites and systems that used it as a reliable source of authorization, including universities, political parties, utility payment platforms, law enforcement agencies, as well as personnel information from the Ministry of Internal Affairs.
The mentioned OAuth server was used in the digital government system for user identification. According to available data, as a result of the hack, data of more than 15 million users was stolen.
The system of the National Social Protection Agency (IHMA), which stored citizens' medical data, was also compromised. The leak of personal data related to the Ministry of Internal Affairs (IIV.UZ) is also linked to the incident on the electronic government's OAuth server. Similar issues affected the systems of the National Statistics Committee of Uzbekistan (STAT.UZ) and the Uzbekistan Mortgage Refinancing Company (UZMRC.UZ).
Most of the leaked data contains the following personal information:
- first and last name,
- residential address,
- date of birth,
- phone number,
- email address,
- passport number.
The hacker group distributed personal information of thousands of citizens to verify the authenticity of the data. The online publication Daryo.uz reports that they have files containing complete personal data of citizens, including copies of passports, medical certificates, and photographs.
The Telegram channel Kurbanoff.net clarified that this data pertains to the year 2023.
On January 31, the National Social Protection Agency reported on preventive work being carried out in the information system "Unified National Social Protection." As a result, disruptions in the provision of electronic services on the portal my.gov.uz were expected until 5:00 AM on February 2.
The National Statistics Committee stated that there are no grounds for concern regarding the security of personal data related to the census.
“The data is securely protected in accordance with national information security requirements, and their leakage through external sources is impossible,” the statement said.
It was also noted that during the census, photographs of citizens were not uploaded to the database.
