Loading story…
A dark web seller has advertised a dataset allegedly containing personal information on about 15 million people in Kazakhstan, claiming the data was stolen from the country’s eGov platform. Reports said the archive was offered for roughly 0.5 bitcoin—about $32,000—and was described as a 2.7 GB file with 47 million rows. The listing allegedly included passport details, phone numbers, email addresses, employment information, website passwords, and document scans, although key elements of that description have not been independently verified.
Kazakhstan’s Ministry of Artificial Intelligence and Digital Development said it is examining the claim but has found no confirmed evidence so far that government e-services were breached or that the data originated directly from eGov. Officials said specialists are analyzing samples and cautioned that large databases sold online can be assembled from older leaks and multiple sources. The alleged sale comes after other major personal-data exposures in Kazakhstan, including a 2025 incident affecting more than 16 million records and another 2026 case involving a seized database, intensifying scrutiny of data protection as the country expands digital public services.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Two months before the current allegation, police seized another large database containing personal information on nearly 16 million Kazakhstanis from employees of a collection agency in the Zhetysu region. The references say it is not known whether that dataset is connected to the newly advertised one.
In April 2026, Kazakhstan’s National Security Committee said the criminal case related to the 2025 leak remained under investigation. It disclosed no further details, citing confidentiality.
In September 2025, Kazakhstan’s Ministry of Digital Development, Innovation, and Aerospace Industry was rebranded as the Ministry of Artificial Intelligence and Digital Development. This changed the ministry name used in later official statements on data-leak allegations.
In July 2025, Kazakh government officials said inspections found no breaches of government information systems related to the June 2025 leak. They said the circulating database contained outdated information current as of 2022 and was compiled from previous leaks, partly supplemented by users with official access.
Kazakhstan’s Ministry of Digital Development, Innovation, and Aerospace Industry announced an investigation into the June 2025 leak of citizen data. The probe followed public reporting that millions of records were circulating online.
Earlier in June 2025, Kazakh authorities detained a network of more than 140 people allegedly involved in selling personal data via Telegram. The references do not state whether this action was directly tied to the later-reported June 2025 archive.
In June 2025, the SecuriXy.kz Telegram channel reported that an archive containing data on 16.3 million Kazakhstani citizens had leaked and was posted on a hacker forum for free download as “Residents of Kazakhstan 2024.” The archive reportedly included identification numbers, phone numbers, names, dates of birth, and addresses.
Kazakhstan’s Ministry of Artificial Intelligence and Digital Development said a preliminary review found no confirmed evidence that government e-services were breached or that the advertised database came directly from eGov. The ministry said specialists were analyzing samples and noted inconsistencies between the seller’s description and eGov’s data structure.
A dataset allegedly containing personal information on 15 million people in Kazakhstan was advertised for sale on the dark web for about $32,000 or 0.5 bitcoin. The seller claimed the data came from a hack of Kazakhstan’s eGov service and described the file as containing passport details, phone numbers, email addresses, passwords, and document scans.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kazakhstan’s Ministry of Artificial Intelligence and Digital Development proposed introducing **criminal liability for mass leaks of citizens’ personal data** and raising administrative penalties for failures to meet information security requirements. The proposal was presented by First Deputy Minister **Rostislav Konyashkin** during a government meeting, framing the move as a “**zero tolerance**” approach to mishandling personal digital data and positioning data protection as a core element of the country’s digital transformation agenda. Reporting indicated the initiative would also **increase the maximum administrative fine** for officials violating information security standards from roughly **$17,000 to about $42,500**, and would apply across **government agencies, quasi-public entities, financial institutions, and private companies** handling large volumes of personal data. Separately, President **Kassym-Jomart Tokayev** publicly emphasized elevating personal data protection to a constitutional-level right, signaling broader political backing for stricter enforcement and accountability around large-scale data breaches.
Jun 29, 2026
Armenian authorities opened an investigation after a threat actor using the alias **dk0m** advertised for sale a dataset allegedly containing nearly **8 million** government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for **$2,500** and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s **government email infrastructure** had been breached while acknowledging the possibility that another state platform was accessed. Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the **electronic civil litigation** platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at **CyberHUB-AM** assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses **infostealer malware** to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to **August 2024** were cited as supporting evidence. The alleged exposure could increase **social engineering** risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.
Jun 29, 2026
Dark web monitoring reports described **unverified data leak claims** involving several organizations, including French parcel delivery firm **Colis Privé**. One post on **BreachForums** allegedly offered an upload of **22,564,381 records** attributed to Colis Privé, described as `.jsonl` files totaling **~4.1 GB**; no specific threat actor attribution or company confirmation was cited, and the notice characterized the situation as informational while scope is assessed. If authentic, the scale and format of the dataset would materially increase risk of **identity theft, credential stuffing, and targeted phishing** against customers. Separate dark web forum posts also alleged database exposures affecting **JobsGO** (Vietnam recruitment platform), **MyVete** (veterinary management platform), **PIXPAY** (Senegalese payment service), and **Groupe Fondasol** (France-based engineering). The claimed datasets reportedly include **CV/personal records**, and in some cases **API credentials and employee metadata**, with example figures including **~2.3 million records** for JobsGO and **~5.57 million records** for MyVete (verification not indicated). Across the claims, the primary business risk is downstream abuse of exposed personal and operational data for **social engineering, recruitment fraud, and account takeover**, rather than immediate exploitation of a specific software vulnerability.
Jun 29, 2026