A darknet forum user under the handle shymzz13 has put up for sale a database which, according to their claim, contains the personal data of 15 million residents of Kazakhstan. The seller stated that the information was obtained after hacking the state service eGov.
HOW INFORMATION ABOUT THE DATABASE EMERGED
According to Mash, the user asked for 0.5 bitcoin for the file. At the time of publication, the value of the cryptocurrency is $63,600 or 29.6 million tenge.
According to the seller's description, the file, which is 2.7 GB in size, contains 47 million rows of various information about Kazakh citizens. The listing also claims that the database includes passport details, phone numbers, email addresses, employment information, document scans and passwords.
However, there is no information about the origin of the database or its currency. The post also does not clarify whether the published file is actually linked to eGov systems.
WHAT IS KNOWN ABOUT THE CONSEQUENCES
At present, there is no confirmation that the database published on the darknet forum actually contains the data of 15 million Kazakh citizens and was obtained as a result of an eGov hack.
CONTEXT
The issue of personal data protection in Kazakhstan has repeatedly become a focus of attention amid reports of possible leaks and vulnerabilities in state digital services.
For example, after registering a new limited liability partnership against an eGov-registered phone number, commercial calls from banks, insurance companies and organisations offering certificates or training courses can begin within just a few hours. Meanwhile, representatives of the information security committee reported that the internal procedures of some companies allowed personal data to be passed on.
Each year the committee receives around 9,000 complaints on information security matters, yet over two years only 180 cases reached court — around 1% of complaints per year.
According to statements from representatives of the Ministry of Artificial Intelligence and Digital Development, leaks can occur not only through state systems but also as a result of phishing, telephone fraud, malicious QR codes, as well as from private information systems and microfinance organisations.
Amid these reports, Kazakhstan is also discussing tougher penalties for personal data leaks. First Vice-Minister for AI Rostislav Konyashkin announced a proposal to introduce criminal liability for mass leaks. Administrative fines for breaches of security requirements are planned to be raised to 5,000 MCI, or 21.6 million tenge.
