The Butterfly hacking collective announced on social media that it breached a database containing the personal records of more than 27 million Uzbek citizens. As proof of the intrusion, the cybercriminals leaked personal details belonging to Uzbekistan’s Minister of Digital Technologies, Sherzod Shermatov, reports Podrobno.uz.
According to the perpetrators, they obtained access to a repository containing full names, mobile phone numbers, personal identification numbers (PINFL), home addresses, passport details, and biometric photographs of Uzbek citizens.
Butterfly issued an ultimatum to Uzbek authorities: if their demands are not met by the morning of November 2, the stolen database will be put up for sale on the dark web—a hidden layer of the internet inaccessible via standard web search engines and conventional browsers.
The hackers' exact demands remain undisclosed, and it is not yet known whether the compromised data has already been posted as a dark web listing. Competent state authorities have not issued a formal comment on the matter.
The development follows media reports several days ago regarding a data leak from Safe Road, a traffic safety platform run by the Ministry of Internal Affairs. Several bloggers, including Shukhrat Kurbanov of the Kurbanoff.net Telegram channel, investigated the claims and verified that their own personal information had appeared in the public domain. Although platform developer AUTODOC denied that any leak occurred, the Interior Ministry and the State Security Service’s Cybersecurity Center have launched an official inquiry.
On November 1, the Telegram channel Troll.uz published an account by a software developer who uncovered a critical flaw on an Uzbek ministry portal that exposed the sensitive data of up to 40 million citizens.
The specialist noted that reporting the flaw proved difficult, as ministry officials initially claimed that «everything was fine.» Only after bringing the external programmer to their office did administrators of the government portal acknowledge the issue and pledge to resolve it.
Nearly a week later, the vulnerability remained active, prompting the specialist to alert the Cybersecurity Center. Only then did the agency intervene, spending eight days fixing the security hole before asking the whistleblower to verify the patch. Officials also asked the developer not to disclose the incident publicly.
A public leak could have triggered catastrophic consequences: the specialist estimated potential economic damages at roughly $50 per compromised account, which criminals could exploit for fraudulent credit applications and identity theft, amounting to nearly $2 billion nationwide.
Furthermore, commentators emphasized that Uzbekistan lacks a mature vulnerability disclosure framework: there is no mechanism for anonymous reporting, no transparent remediation timeline, and no public acknowledgment of security research. The country also lacks bug bounty rewards, meaning researchers can at best obtain a formal letter of appreciation upon written request.
Butterfly is a professional hacking syndicate known for corporate espionage. First tracked in 2013, the group has reportedly targeted several major tech corporations, including Apple, Facebook, and Microsoft.
