An advertisement previously appeared on the dark web offering a dataset that, according to the seller, contains information on approximately 15 million citizens of Kazakhstan. The seller claimed that the data had been obtained by hacking eGov.
What did the seller claim?
The advertisement offered data on approximately 15 million Kazakhstanis for 0.5 BTC.
According to the seller, the dataset contained full names, Individual Identification Numbers (IINs), phone numbers, dates of birth, employment information, password hashes, scans of documents and other information.
Kazakhstan’s Ministry of Artificial Intelligence and Digital Development denied reports that the data had been leaked from eGov. Together with the relevant authorities, the Ministry conducted a technical investigation and found no evidence that eGov information systems had been compromised.
The Ministry also obtained access to the files offered for sale on the dark web and analysed them.
What did the investigation find?
According to the Ministry, the dataset offered for sale is a collection of various files and images and is not a data dump from eGov.
The Ministry cited several other findings supporting this conclusion:
- the volume and contents of the dataset claimed by the seller are inconsistent;
- eGov systems do not contain a database of passport scans in the format presented by the author of the advertisement;
- digital documents are generated and stored differently within eGov systems.
The Ministry therefore officially stated that eGov had not been hacked and that claims that data on 15 million citizens of Kazakhstan had been obtained from its systems were false.
Source: Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.
