Uzbekistan Reportedly Experiencing Multiple Hacker Attacks

Uzbekistan could be grappling with a digital disaster in which a hacker group dubbed Butterfly reportedly broke into a government database and obtained the personal information of roughly two-thirds of the country’s almost 40 million population.

“After more than a year of persistent work, we obtained a complete copy of a restricted internal database belonging to the Personalization Agency under the Ministry of Justice,” Butterfly asserted in a publicly posted message , written in English. The message went on to demand that authorities “destroy the data on our terms, or the archive goes to the highest bidder,” adding that specific instructions had been relayed to Uzbek officials via a “private channel.”

The group gave Uzbek officials until November 2 to comply. As proof of the hack, the group posted personal data of Digital Technologies Minister Sherzod Shermatov.

The Uzbek government has not confirmed or denied the hack, which could impact up to 27 million people, including Uzbek nationals and foreign residents. An Uzbek news outlet, Podrobno.uz , broke the news. But many major, government-aligned news outlets, such as Daryo.uz and UzDaily, did not publish any reports the Butterfly attack.

The hackers reportedly gained access to not only names, addresses, phone numbers and passwords, but also passport and biometric data.

While so far not responding to the reported Butterfly attack, Uzbekistan’s Ministry of Internal Affairs announced October 29 it was investigating a separate, suspected data breach, this one reportedly affecting a digital platform called SAFE Service, which facilitates payments by citizens for such state services as auto registration, as well as fines and insurance.

In what may be a related development, Telegram channels in Uzbekistan have come under attack in recent days, with hackers using hijacked accounts to dupe some users into clicking on links that give the malicious actors access to readers’ own account information.

“Using the compromised account, the scammers then send further fraudulent messages to the victim's contacts—for instance, by asking friends or family members to urgently transfer money to a bank card,” according to an October 31 report published by Techora.ru, a Russian technology-focused news outlet.

On November 1, a popular Uzbek blogger, Umid Gafurov, posted an item on his Telegram channel, Troll.uz, that suggested Uzbek government cybersecurity protocols were lax. He shared a story of a programmer who supposedly in late September alerted officials to a vulnerability in the database that was reportedly just hacked into by the Butterfly group.

According to the second-hand account offered by Gafurov, authorities initially treated the programmer’s caution with skepticism.

“When the programmer managed to relevant specialists through another official channel and explain the problem in person at a meeting at the agency, they told him they were aware of the error but didn't consider it urgent, citing recently completed security checks,” Gafurov wrote.