Asia·Uzbekistan
Hackers claim they stole the personal data of 27 million Uzbeks, and the government has not said whether it is true
TASHKENT, Uzbekistan —
| Score | Meaning | Major U.S. outlets that covered it |
|---|---|---|
| 10 | Fully overlooked ← this story | 0 of 13 outlets |
| 8 | Barely covered | 1 outlet |
| 6, 5 | Lightly covered | 2 outlets (6) · 3 outlets (5) |
| 4, 3 | Covered | 4 outlets (4) · 5 outlets (3) |
| 2, 1, 0 | Widely covered | 6–7 outlets (2) · 8–10 outlets (1) · 11–13 outlets (0) |
Provisional: Google News (5 term variants for AP, Reuters and The Washington Post; 3 for the others) and Bing News (5 variants, outlet domain only) were both used. AP, Reuters and CBS News block direct site search, and the other 10 outlets’ site search only loads in a live browser. A single search engine can miss articles, so this score may go down on recheck.
Depth
Dig five layers into this story — from what happened to the full picture.
L1What happened
Butterfly wrote, in English: "After more than a year of persistent work, we obtained a complete copy of a restricted internal database belonging to the Personalization Agency under the Ministry of Justice." It demanded that officials "destroy the data on our terms, or the archive goes to the highest bidder" (Eurasianet). FBRK gives the deadline as Nov. 2, 2026, 08:00 Tashkent time. FBRK said that at the time of its report there was no independent confirmation that the threat had been carried out.
L2Who’s affected
Up to 27 million people, Uzbek nationals and foreign residents, could be affected if the claim is true (Eurasianet). Zamin.uz says the group claims records on 27,174,051 citizens, including full names, birth dates, personal identification numbers (PINFL), passport series and numbers, addresses, phone numbers and photos; Eurasianet also reports passwords. As a sample, the group posted Minister of Digital Technologies Sherzod Shermatov's full name, date of birth, PINFL and phone number (Zamin.uz).
L3Why it’s quiet
Eurasianet reports that Podrobno.uz broke the story, while "many major, government-aligned news outlets, such as Daryo.uz and UzDaily, did not publish any reports about the Butterfly attack."
L4Deeper impact
Sherzod Akhmadov, press secretary of the Ministry of Digital Technologies, said verifying such reports is up to the Cybersecurity Centre under the State Security Service, which gave journalists no official response (FBRK, citing Vaqt.uz). On Oct. 29 the Interior Ministry said it was investigating a separate suspected breach of SAFE Service, a platform for paying state fees, fines and insurance (Eurasianet); FBRK says SAFE Service denied any link to the published data. Blogger Umid Gafurov wrote that a programmer warned officials about a database flaw in late September and was told they "didn't consider it urgent" (a secondhand account, via Eurasianet).
L5Full context
The former Personalization Agency's migration and personalization functions moved to the Interior Ministry in January 2026 (FBRK). FBRK also says Shermatov earlier confirmed that the systems of three state agencies were attacked from Jan. 27 to 30, after reports of 15 million leaked records; a preliminary check found about 60,000 records were involved, and passwords for the OneID identification system were then updated. Hijacked Telegram accounts have also been used in recent scams in Uzbekistan (Eurasianet).
You’ve reached the bottom. Read the original reporting below.
Original reporting
- EurasianetUzbekistan reportedly experiencing multiple hacker attacksNov 2, 2026 ↗
- Zamin.uzAre the data of 27 million Uzbeks at risk? A sensational ultimatum has been issuedNov 1, 2026 ↗
- FBRK (Kazakhstan anti-corruption investigative bureau)Hackers BUTTERFLY claim to have obtained data on 27 million residents of UzbekistanNov 2, 2026 ↗
Status history (3 events, ET)
- O-Score check: 10 (Fully overlooked) · 0 of 13 outlets counted
- Published
- O-Score recheck: 10 (Fully overlooked) · 0 of 13 outlets counted
CybersecurityData breachPrivacyGovernment
This is an OVERLOOKED summary of the reporting above. Facts and figures come from the linked sources. Everything here is a fact unless it is labelled otherwise. Support this work.
Alerts Get stories like this your way: email, a daily PDF paper, notifications, RSS, or alerts on topics you follow. Choose how →