The hacker group BUTTERFLY reported discovering critical vulnerabilities in Uzbekistan’s state information systems, including the infrastructure of the former Personalization Agency. Earlier, reports emerged claiming that attackers allegedly gained access to a database containing information on more than 27 million citizens and threatened to put it up for sale on the darknet if authorities did not contact them. However, the group itself stated that there was no actual database leak.
To demonstrate their capabilities, BUTTERFLY members published personal details of Minister of Digital Technologies Sherzod Shermatov. According to the hackers, this data was already publicly available and was gathered using OSINT techniques. The group refers to itself as an ethical hacker community and claims that its goal is to improve the security level of the digital infrastructure rather than cause damage. It described the published materials as a warning about security issues.
BUTTERFLY intends to regularly report on identified threats and recruit new members to its team, with selection criteria promised to be disclosed later. Meanwhile, there is currently no independent confirmation of the breach claims or the detected vulnerabilities. The structure of the former Personalization Agency, which might have been affected by the incident, was transferred to the system of the Ministry of Internal Affairs of Uzbekistan in January 2026. The actual extent of the potential compromise remains to be determined by authorized agencies.