Tashkent, Uzbekistan (UzDaily.uz) — The hacker group BUTTERFLY has claimed to have discovered vulnerabilities in Uzbekistan's government information systems, including infrastructure formerly operated by the Personalisation Agency. However, the group has denied carrying out an actual data breach involving a database containing information on more than 27 million citizens.
Earlier reports circulated online alleging that BUTTERFLY had gained access to the former Personalisation Agency's information systems and obtained a large database of personal information. The group also reportedly demanded that government authorities establish contact, threatening to put the database up for sale on the dark web if they failed to respond.
To support its claims, the group's members published personal information about Digital Technologies Minister Sherzod Shermatov. However, there has been no independent confirmation that the entire database was compromised.
BUTTERFLY subsequently published a statement describing itself as a community of ethical hackers. Its members said they had no destructive intentions and aimed to help improve cybersecurity in Uzbekistan.
According to the group, the materials circulated earlier were intended as a warning rather than evidence of an actual data leak or malicious cyberattack. BUTTERFLY claimed to have identified several critical vulnerabilities and data leaks in government digital platforms, accusing the relevant authorities of paying insufficient attention to information system security.
The group separately explained that the information published about the digital technologies minister had, according to its claims, already been available in public sources and could have been identified using open-source intelligence (OSINT) techniques.
BUTTERFLY also announced plans to regularly publish information about identified threats and vulnerabilities.
In its statement, the group said it intended to recruit new members. Details of the selection process are expected to be published at a later date.
The structure of the former Personalisation Agency, which was reportedly affected by the incident, was transferred to the Ministry of Internal Affairs system in January 2026.
As of now, the group's claims about the identified vulnerabilities and possible access to government information systems have not been independently verified. The actual scale of the incident and the security status of the affected platforms can be established following an investigation by the authorised authorities.
