Data of 15 Million Kazakhstanis Allegedly Leaked

Hackers have allegedly posted the personal data of 15 million Kazakhstani citizens for sale on the dark web. If confirmed, this would mark the second major breach of Kazakhstani citizen data in a little over a year.

According to RFE/RL, the Mash Telegram channel, which the outlet characterized as linked to the Russian security forces, reported that hackers had put the personal data of 15 million Kazakhstani citizens up for sale on the dark web. The seller reportedly claimed to have obtained the data after hacking Kazakhstan’s eGov service. The file is apparently valued at around $32,000 and, the seller claims, contains passport information, phone numbers, email addresses, document scans, and website passwords.

Kazakhstan’s Ministry of Artificial Intelligence and Digital Development acknowledged the reports and is reviewing them. In a statement posted to Telegram, the ministry said, “At this time, there is no confirmed evidence of a breach of e-government information systems or that the database in question was obtained directly from eGov.” The ministry cited inconsistencies between the claim and the structure of the eGov platform.

Data breaches are a fact of modern life the world over. Governments, including Kazakhstan’s, have increasingly pushed to digitalize services. On the one hand, the elimination of physical paperwork and office visits speeds service delivery, eliminating layers of bureaucracy and opportunities for petty corruption. But on the other hand, e-government introduces new risks, can obscure decisionmaking, and provides novel opportunities for corruption and crime. 

This latest report of leaked citizen data is not the first breach. In June 2025, the SecuriXy.kz Telegram channel reported that an archive containing information on 16.3 million Kazakhstani citizens had been leaked. The files reportedly contained 15.8 million IINs (individual identification numbers), 17 million phone numbers, alongside full names, dates of birth, and addresses.

At the time, SecuriXy.kz reported, “Analysis shows that most of the records are dated 2022, but relevant data from 2023–2024 was also discovered in the archive. This means the leak is recent and poses a real threat. This data could be used for phishing, document forgery, attacks on eGov and mobile banking accounts, and phone fraud.”

The file was reportedly posted on a hacker forum for free download under the title “Residents of Kazakhstan 2024.”

In its initial reporting on the incident, RFE/RL cited cybersecurity experts as suggesting three possible sources: “semi-open government service APIs, hacking of poorly configured platforms, or unauthorized downloads from integration systems.”

Kazakhstan’s Ministry of Digital Development, Innovation, and Aerospace Industry – rebranded in  September 2025 as the Ministry of Artificial Intelligence and Digital Development – quickly announced an investigation. In July 2025, Kazakh government officials appeared to downplay the significance of the leak. In a statement carried in the Astana Times, the ministry said, “The inspections confirmed that there were no breaches of government information systems. It was established that the database circulated on the internet contained outdated information, current as of 2022. The data originated from previous leaks and was partially supplemented by users with access to the systems as part of their official duties.”

Incidentally, earlier in June 2025, Kazakh authorities had detained a network of more than 140 people allegedly engaged in the selling of personal data via Telegram. 

Kazakhstan is leaning into the supposed AI future. Astana declared 2026 the “Year of Digitalization and Artificial Intelligence” and in late 2025 passed Central Asia’s first comprehensive AI law. In June, Kazakhstan signed a $10 billion package of agreements with Firebird and Nvidia to build the Data Center Valley in Ekibastuz. Earlier, in May, a presidential decree that got little media attention at the time granted the National Security Committee (KNB) new responsibilities, including making the security agency a direct participant in the AI buildout.