A hacker group calling itself BUTTERFLY claims to have exfiltrated the closed database of Uzbekistan's Agency for Personalization, an office under the Ministry of Justice responsible for maintaining citizen identity records. The alleged dataset holds records for 27,174,051 people. The government has issued no confirmation or denial.
What data is claimed to be in the breach
According to BUTTERFLY's own disclosure, the database contains: full names and dates of birth, PINFL identifiers (Uzbekistan's national personal identification number), passport series and numbers, registered home addresses, phone numbers, and biometric photographs. If accurate, this is essentially the complete identity record for the majority of Uzbekistan's adult population.
How the group proved the claim
Rather than releasing the full archive, BUTTERFLY posted a sample containing the personal details of Digital Technologies Minister Sherzod Shermatov, including his phone number and national ID data. The decision to target the minister personally is a deliberate pressure tactic: it forces the government to respond to a named, verifiable fact, or to remain silent in a way that reads as confirmation.
The group set a 48-hour deadline demanding that officials destroy the data. That deadline passed on November 2. BUTTERFLY says the archive will be sold to the highest bidder on the darknet if its conditions are not met.
The government response has been silence
As of this writing, no official statement has come from Uzbek government agencies, the Cybersecurity Center, or UzCERT. Major state-aligned outlets including Daryo.uz and UzDaily did not cover the story. The story broke on Podrobno.uz and was picked up by Eurasianet and regional wire services.
Minister Shermatov did make a separate public statement calling for urgent cybersecurity measures across government and commercial sectors: continuously finding and fixing vulnerabilities, allocating more cybersecurity funding (specifically for AI-related threats), and training more specialists. He cited the recent $6.3B Binance theft as context for why these investments matter. He stopped short of confirming the breach.
A parallel breach under investigation
Separately, the Ministry of Internal Affairs is investigating a suspected breach of SAFE Service, a government digital platform handling citizen payments of state fees, fines, and insurance. That incident was announced on October 29, before the BUTTERFLY claims surfaced. Whether the two incidents share infrastructure, tools, or threat actors is unconfirmed.
Why the PINFL matters for downstream fraud
The PINFL is Uzbekistan's national personal identification number, used across government systems, banking onboarding, and financial transactions. Combined with biometric photos and passport data, a dataset like this enables sophisticated identity fraud: account takeover at Uzcard, Humo, Kapitalbank, and other institutions; targeted spear-phishing with personally verified details; and SIM-swap attacks against phone numbers confirmed in the database.
Uzbekistan's fintech sector is growing fast. The country approved a fintech development strategy through 2030 and has attracted over $1 billion in fintech investment commitments. That growth creates a larger attack surface tied to identity infrastructure. A breach of this scale, if confirmed, would be one of the largest government data exposures in Central Asia on record.
What to watch
Watch for confirmation or denial from UzCERT and the Ministry of Justice. If BUTTERFLY follows through on a sale, the archive will likely surface on established darknet markets within days. Organizations with Uzbekistan-based employees or customers should prepare for credential-stuffing and spear-phishing campaigns using this data. Banks and financial institutions in the region should review account-opening processes for identity fraud indicators.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization operates in Central Asia or has customers in Uzbekistan.