The hacker group BUTTERFLY has claimed it breached the database of the former Personalisation Agency of Uzbekistan and obtained more than 27 million records on citizens. Among the allegedly obtained data are passport details, residential addresses, phone numbers and biometric photographs. There is as yet no independent confirmation of the leak.
WHAT THE HACKERS CLAIMED
According to Zamin.uz, the BUTTERFLY group announced that it had gained access to the database of the Personalisation Agency of Uzbekistan. The hackers claim it contains information on more than 27 million citizens.
The alleged data include passport information, phone numbers, residential addresses and biometric photographs that can be used to identify a person. The group also claimed to have published the personal details of Minister of Digital Technologies Sherzod Shermatov.
As proof of its claims, the hackers released part of the information.
The group set a deadline for representatives of state bodies — 2 November 2026, 08:00 Tashkent time. If no one contacts it, the hackers promised to put the obtained database up for open sale. At the time of publication there is no independent confirmation that this threat has been carried out.
WHAT THE STATE BODIES RESPONDED
As reported by Vaqt.uz, press secretary of the Ministry of Digital Technologies Sherzod Akhmadov explained that the verification of such reports and the establishment of the fact of a cyber-attack fall within the competence of the Cybersecurity Centre under the State Security Service.
Journalists also attempted to obtain a comment directly from the Cybersecurity Centre. However, the agency did not provide an official response.
WHY THE MENTION OF THE AGENCY REQUIRES CLARIFICATION
The hackers name as their target the former Personalisation Agency under the Ministry of Justice of Uzbekistan. However, since January 2026 the organisational structure of this area has changed. Functions in the field of migration and personalisation were transferred to the system of the Ministry of Internal Affairs (MIA). In place of the former Agency, a Department of Migration and Personalisation under the MIA was created.
At the same time, the document provides for the merging of the databases of the Personalisation Centre with the “Passport-Visa” information system. The work on integration was assigned to the MIA together with the Ministry of Digital Technologies.
CONTEXT AND SIGNIFICANCE
The new episode emerged against the backdrop of reports about the security of state and other digital systems in Uzbekistan.
In February 2026 Minister of Digital Technologies Sherzod Shermatov commented on reports of allegedly leaked data of 15 million citizens. He confirmed that from 27 to 30 January the information systems of three state agencies were subjected to cyber-attacks.
However, the initial assessment of the scale turned out to be overstated: according to the results of a preliminary check, it concerned approximately 60 thousand records, not 15 million citizens. The authorities reported that after the incident they restricted further unauthorised access, updated user passwords of the Unified Identification System OneID and strengthened technical protection.
In addition, the FBAC has previously written about a possible leak of data related to the SAFE Service platform in Uzbekistan. At that time the Cybersecurity Centre, the MIA and the company AUTODOC joined the investigation. SAFE Service denied any connection between the published data and its platform.
