A threat group calling itself BUTTERFLY claims to have exfiltrated 27 million records from Uzbekistan's e-government portal, e-xalqaro.uz. The dataset includes citizens' passport numbers, taxpayer IDs, and addresses. If confirmed, it is the largest single data exposure in Central Asian government infrastructure on record.
What was taken
BUTTERFLY posted samples on a Telegram channel this week. The samples, reviewed by Zamin.uz, include structured records consistent with a government identity registry: full legal names, birth dates, national ID numbers, and registered addresses. The group claims total coverage of Uzbekistan's adult population.
E-government portals are attractive targets precisely because they aggregate identity data at a national scale. A single successful intrusion yields records equivalent to years of corporate breach accumulation.
The e-government risk model
Uzbekistan's digital government push has been aggressive, centralizing services that previously required in-person visits to ministry offices. That centralization creates efficiency gains and a concentration risk: the same portal that streamlines a tax filing or business registration becomes a single point of failure for 36 million people's identity data.
The pattern is not unique to Uzbekistan. Georgia's own e-government stack, which shares architectural lineage with the region's post-Soviet digital modernization programs, faces the same concentration tradeoff. Building citizen-facing digital services fast and centralized is a political win; securing the backend at the same pace is an engineering problem that rarely gets equivalent funding.
What defenders in similar environments should audit
For security teams managing national or regional government infrastructure, this breach suggests three audit priorities:
- API authentication on internal registry endpoints: BUTTERFLY's posted data structure suggests direct database or API access rather than web scraping
- Data minimization at the portal layer: citizen portals rarely need to surface raw national ID numbers; tokenized references that resolve only inside the ministry's trust boundary reduce breach blast radius
- Incident response agreements with national CERTs: Uzbekistan's cert.gov.uz has not issued a public statement as of this writing; a delayed response compounds reputational damage and complicates breach notification obligations
The durable lesson
Data aggregation for government efficiency is a legitimate policy goal. The security debt it creates is a governance problem, not just an engineering one. When a single breach can expose an entire nation's identity layer, risk management has to be part of the digital transformation budget from day one, not retrofitted after an incident.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization needs help modeling e-government data risks or building incident response capability.