Personal data leak in Uzbekistan: investigation launched, no results yet

What happened

In late October 2026, reports spread on social media that the personal data of Uzbekistan's citizens — PINFL (personal identification number), addresses and passport details — had become publicly available. Some users said they had found their own data in Telegram bots and posted screenshots as proof. Gazeta.uz previously compiled these reports into a separate article, and has now published a lengthy interview with cybersecurity specialist Akmal Sodikov about how such leaks occur.

An investigation without results

Following these reports, the Cybersecurity Center under the Ministry of Internal Affairs and the State Security Service announced the start of an investigation. However, as Gazeta.uz notes, by the first week of November no official results had been announced, and it is unknown what stage the investigation is at.

Where data leaks from

According to Sodikov, most leaks occur not in the application itself but on the server side. The main causes are: authorization errors in APIs (when the server does not verify a user's right to request someone else's data — which, he says, is the most common vulnerability in the world), improperly configured storage — databases, backups and test servers left open without passwords, insider actions, and third-party services — analytics and advertising SDKs, SMS gateways, cloud services. A significant share of Telegram 'doxxing' services, the expert noted, operate precisely through insiders.

Why a leak is dangerous and what to do

The main risk for a person whose data has been exposed is social engineering: knowing a person's full name, phone number and PINFL, a fraudster can convincingly pose as a bank or government employee and trick them into revealing an SMS code or card details. Attempts may also be made to take out a microloan in someone else's name or reissue their SIM card. Sodikov advises never sharing SMS codes or card details with anyone (a genuine bank or government agency never asks for them, least of all via Telegram), enabling two-factor authentication in banking apps and on my.gov.uz, periodically checking one's credit history, asking the mobile operator to restrict SIM card reissuance, and contacting the bank and law enforcement agencies in suspicious situations.

Data cannot be removed from the internet

The expert stressed that it is practically impossible to completely remove data that has already leaked from the internet: once copied, it spreads across dozens of channels and archives. Blocking individual channels and filing complaints with platforms only reduce its spread. Paid 'data hiding' services, he said, conceal results only within a specific service, and paying for them effectively funds this market. Therefore, Sodikov believes, the main focus should be on mitigating the consequences, given that the data is already public. A victim can go to court, and the data operator bears liability for the damage caused.

What the expert proposes to change

Sodikov proposed a set of measures for applications handling personal data in Uzbekistan: mandatory independent penetration testing before launch (annually for apps integrated with government databases), data minimization and masking, authorization checks on every API request, encryption in transit and at rest, access auditing (which, he says, is the most effective tool against doxxing), an open channel for vulnerability reports, and clear deadlines for incident notifications. He emphasized that these requirements must not remain on paper, and that real liability must follow violations.