Data of 15 million citizens in Kazakhstan reportedly leaked onto the darknet

On August 12, 2026, the Telegram channel Mash of Kazakhstan reported that the personal data of 15 million Kazakhstani citizens had been put up for sale on the darknet.

According to the report, this data represents nearly three-quarters of Kazakhstan's population. On the darknet, a user operating under the alias shymzz13 claimed to have obtained the database by breaching the government's eGov e-government system.

According to the available information, the 2.7-gigabyte file contains 47 million rows of data. It reportedly includes citizens' passport details, phone numbers, email addresses, workplaces, document copies, and passwords.

The seller valued the database at 0.5 bitcoin, or approximately $32,000.

However, Kazakhstan's Ministry of Digital Development, Innovation and Aerospace Industry said the information had not yet been confirmed. The ministry said it was technically examining the leaked data together with the relevant services. In particular, the samples included in the listing are being analyzed to determine their source.

Ministry representatives said there is currently no evidence confirming that eGov information systems were breached or that the database was obtained directly from eGov.

The ministry also noted that some of the information in the circulated report does not match the structure and format of data in the e-government system. In particular, it said that scanned copies of passports are not stored in eGov in the alleged form, while digital documents use a different format.

The ministry stressed that the darknet user's claim that the database was obtained by breaching eGov cannot, by itself, serve as evidence that the system was hacked.

The technical investigation is currently ongoing. Additional information is expected to be provided based on its results.

The ministry advised Kazakhstan's citizens to follow digital security rules. In particular, they were asked not to share SMS codes, passwords, or electronic digital signature credentials with others, not to open suspicious links, and not to use the same password for different services.