Hackers walk back claim of Uzbekistan data leak affecting 27 million
A group calling itself Butterfly first claimed it had taken the personal data of more than 27 million Uzbek citizens from a state database, then softened the claim into a "white-hat" vulnerability warning. No actual breach has been officially confirmed.
A hacking group calling itself Butterfly has backed away from its initial claim that it had obtained the personal data of more than 27 million citizens from an Uzbek state database. By November 3 the group recast itself as a community of "white-hat," or well-intentioned, hackers, said it had stolen no data, and claimed the episode was in fact a warning about vulnerabilities in government systems. No actual breach has yet been officially confirmed.
The initial claim
The group had initially announced, via a darknet page and social media, that it had breached a state database and gained access to the data of more than 27 million citizens. As proof, it posted the personal details of Digital Technologies Minister Sherzod Shermatov, including his phone number. The group also threatened to sell the database on the dark web but named no specific price.
What kind of data is involved
According to the claim, the database contained passport details, addresses, phone numbers, personal identification numbers (PINFL) and biometric photographs. The system in question belongs to the former Agency for Personalization, which was moved from the Ministry of Justice to the Ministry of Internal Affairs in January 2026. The group later said that Shermatov's data had been obtained from open sources (OSINT), not by breaking into the system.
The official response
The Ministry of Internal Affairs said on October 29 that an investigation had been opened; the Cybersecurity Center under the State Security Service was also involved. Minister Sherzod Shermatov warned about the risks of vulnerabilities in outdated systems but did not confirm a breach. As of November 5, authorities had not announced the conclusions of the investigation.
What is confirmed, and what is not
What is confirmed is that the group made a claim, then softened it, and that the authorities opened an investigation. The figure of "27 million" remains an unverified claim by the group; an actual theft of data has not been independently proven, and the state has not confirmed it either. California Uzbek reports the event strictly within verified facts and does not present unverified numbers as established fact.
