Loading story…
Kazakhstan’s Ministry of Artificial Intelligence and Digital Development proposed introducing criminal liability for mass leaks of citizens’ personal data and raising administrative penalties for failures to meet information security requirements. The proposal was presented by First Deputy Minister Rostislav Konyashkin during a government meeting, framing the move as a “zero tolerance” approach to mishandling personal digital data and positioning data protection as a core element of the country’s digital transformation agenda.
Reporting indicated the initiative would also increase the maximum administrative fine for officials violating information security standards from roughly $17,000 to about $42,500, and would apply across government agencies, quasi-public entities, financial institutions, and private companies handling large volumes of personal data. Separately, President Kassym-Jomart Tokayev publicly emphasized elevating personal data protection to a constitutional-level right, signaling broader political backing for stricter enforcement and accountability around large-scale data breaches.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
At a government meeting, First Deputy Minister Rostislav Konyashkin said the Ministry of Artificial Intelligence and Digital Development had proposed introducing criminal liability for mass leaks of citizens’ personal data. The proposal also included significantly higher administrative fines for failing to meet information security requirements as part of a stated "zero tolerance" approach to data mishandling.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A dark web seller has advertised a dataset allegedly containing personal information on about 15 million people in Kazakhstan, claiming the data was stolen from the country’s `eGov` platform. Reports said the archive was offered for roughly **0.5 bitcoin**—about **$32,000**—and was described as a **2.7 GB** file with **47 million rows**. The listing allegedly included passport details, phone numbers, email addresses, employment information, website passwords, and document scans, although key elements of that description have not been independently verified. Kazakhstan’s Ministry of Artificial Intelligence and Digital Development said it is examining the claim but has found **no confirmed evidence** so far that government e-services were breached or that the data originated directly from `eGov`. Officials said specialists are analyzing samples and cautioned that large databases sold online can be assembled from older leaks and multiple sources. The alleged sale comes after other major personal-data exposures in Kazakhstan, including a 2025 incident affecting more than 16 million records and another 2026 case involving a seized database, intensifying scrutiny of data protection as the country expands digital public services.
Aug 12, 2026
Russia’s State Duma has passed a law imposing administrative fines on website and mobile application owners that violate the country’s user-authorization rules, including by failing to provide approved domestic login methods for users in Russia. The measure enforces requirements already in force since 2023 and targets operators of online services rather than end users; people are not being fined for signing in with accounts such as Google, Apple ID, or Gmail. Under the rules, services aimed at users in Russia must offer authentication through a Russian mobile number, **Gosuslugi** (`ESIA`), the **Unified Biometric System** (`EBS`), or another Russian-owned information system, with penalties reported at up to **700,000 rubles** for noncompliance. The legislation also broadens liability in adjacent digital-regulation areas. It introduces penalties for violations involving recommendation technologies, including unlawful collection of user preference data and failure to disclose the use of recommendation algorithms, and it raises sanctions for telecom operators that breach obligations to cooperate with law enforcement during operational-search and security activities. Reports indicate the updated framework includes multimillion-ruble fines and turnover-based penalties for repeat offenses, expanding enforcement pressure across Russia’s online platform and telecom sectors.
Jun 29, 2026
European regulators issued roughly **€1.2B** in **GDPR** fines in 2025 and received an average of **443 personal data breach notifications per day**, signaling increased enforcement and reporting volume alongside overlapping disclosure regimes such as **NIS2** and **DORA**. Ireland remained a leading enforcement authority, including a **€530M** fine against **TikTok**, while large technology firms continued to account for most of the largest penalties; cumulative GDPR penalties since 2018 were reported at **€7.1B**. In the U.S., an **HHS Office of Inspector General** management challenges report highlighted persistent federal healthcare cybersecurity gaps, including inconsistent governance and controls across HHS divisions and heavy dependence on contractors and grantees to implement security measures—conditions that complicate prevention and response as ransomware and other attacks continue to target healthcare. Separately, an academic study on insider risk reported that **58%** of surveyed college students in technology-related programs said they would violate **HIPAA** and disclose patient data for sufficient payment, underscoring the human/insider threat dimension that can drive breach risk and downstream regulatory exposure.
Jul 12, 2026