Social media channels have been actively circulating alarming reports concerning an alleged massive data leak in the darknet involving the personal information of 27 million citizens of Uzbekistan. According to the circulating claims, the compromised database purportedly contains full names, phone numbers, personal identification numbers, residential addresses, passport details, and biometric photographs. To substantiate their breach, the perpetrators allegedly published the personal credentials of the Minister of Digital Technologies.

According to statements attributed to the hackers, unless their undisclosed demands are fulfilled by the morning of November 2, the entire confidential data archive will be released for open sale. Such incidents continuously cast a shadow over the reliability of state-managed digital platforms and the systemic protection of citizens' privacy in the region.

Amidst these growing concerns, blogger Umid Gafurov brought to light an account shared by a software developer who reportedly discovered a critical vulnerability in late September on the platform of one of the republic's ministries. The vulnerability reportedly scored 8.6 out of 10 on the CVSS scale, allowing unauthorized users to scrape data belonging to approximately 40 million individuals without authentication limitations.

The developer's attempts to proactively warn the authorities allegedly met with institutional resistance and indifference. Officials initially dismissed the warnings, citing recent security audits, and the national cybersecurity center reportedly lacked streamlined anonymous reporting channels or bug bounty incentives. The vulnerability was patched only days later, though experts warn that legislative shortcomings and persistent vulnerabilities continue to pose severe economic and security risks.

Source: podrobno.uz