Significant cyber incident
Kazakhstan resident database leak, 2025
The Kazakhstan resident database leak of June 2025 involved a database said to hold 16.3 million records with personal data of Kazakh residents, which appeared in open access.
In short
The Kazakhstan resident database leak of June 2025 involved a database said to hold 16.3 million records with personal data of Kazakh residents, which appeared in open access. The Ministry of Digital Development said most of the data was outdated and no government systems had been hacked. A joint inspection found no breach and said the data dated from 2022. The National Security Committee is investigating a criminal case.
What happened
On 16 June 2025 information appeared that 16.3 million records with personal data of Kazakh residents were in open access. The reported fields include name, sex, date of birth, personal ID number (IIN), address and phone numbers (Tengrinews, 17 June 2025).
On 17 June the Ministry of Digital Development said all relevant agencies were involved and the data was being checked, including how current it was. It said first analysis showed most of the data was outdated and that similar cases in earlier years involved outdated data from service and microfinance databases. It said it was premature to confirm the information before checks ended (Tengrinews).
The Ministry also said the data might have come from private information systems and that no hacking or leaks from government systems had been recorded at that time. It said affected citizens would be told in their personal account on the e-Government portal (Tengrinews, English edition).
The Information Security Committee later said a joint unscheduled inspection by the Ministry, the National Security Committee and the State Technical Service confirmed no breach of government information systems. It said the database held outdated information, current as of 2022, that came from earlier leaks and was partly added to by users with official access (The Astana Times, 29 July 2025).
Timeline
-
2022
The Information Security Committee later says the data in the database is current as of 2022.
-
16 June 2025
Information appears that 16.3 million records with personal data of Kazakh residents are in open access.
-
17 June 2025
The Ministry of Digital Development says the data is being checked and first analysis shows most of it is outdated.
-
17 June 2025
The Ministry says no hacking or leaks from government information systems have been recorded at that time.
-
17 June 2025
The Ministry says affected citizens will be notified through the e-Government portal.
-
By 29 July 2025
A joint unscheduled inspection by the Ministry, the National Security Committee and the State Technical Service takes place.
-
By 29 July 2025
The Information Security Committee says inspections found no breach of government systems and hands the materials to law enforcement.
-
By 30 July 2025
A deputy prosecutor general says a criminal case is opened over the mass leak.
-
30 July 2025
The Ministry of Internal Affairs says the National Security Committee is investigating the case.
How the attack worked
The sources opened do not describe an attack chain, and the origin of the data is disputed. This section sets out what officials say about where the data came from.
What officials say
The Ministry first said the data may have come from private information systems and not from government systems. The Information Security Committee said the database circulating online was outdated, current as of 2022, and came from previous leaks. It said the data was partly added by users who had access to the systems as part of their official duties.
What is not known
The sources opened give no actor, no entry point, no technical indicators and no sale details. Whether the file was a new theft or a compilation of old data is the point on which officials and the first reports differ.
Who says who was behind it
No public attribution. The sources opened name no actor. Sources differ on the nature of the file: the first reports described a leak of 16.3 million resident records, while the Ministry of Digital Development and the Information Security Committee said the data was outdated, current as of 2022, came from earlier leaks and did not come from a breach of government systems.
Impact
The reported file holds 16.3 million records with personal data of residents (Tengrinews, 17 June 2025).
The Information Security Committee says the data is outdated, current as of 2022, and that no government systems were breached (The Astana Times).
Citizens found in the database are to be notified through the e-Government portal.
No financial loss and no fraud cases linked to this file are given in the sources opened.
Government and regulator response
- 17 June 2025: The Ministry of Digital Development said all relevant agencies were involved, a thorough investigation with law enforcement and special agencies was under way, and citizens would be notified through the e-Government portal.
- By 29 July 2025: The Ministry, the National Security Committee and the State Technical Service held a joint unscheduled inspection of information systems.
- By 30 July 2025: A deputy prosecutor general said a criminal case was opened. The Information Security Committee said all materials were handed to law enforcement.
- 30 July 2025: The Ministry of Internal Affairs said the National Security Committee investigates the case.
- Legal basis: The Ministry can run unscheduled inspections on personal data. Violations carry administrative liability and criminal liability under article 147 of the Criminal Code.
Lessons
-
Check the age of leaked data
The Ministry's first step was to test how current the data was. Age decides the real risk to people.
-
Separate old leaks from new breaches
The committee said the file came from earlier leaks. Keep a record of past exposures so you can tell them apart.
-
Insiders count
The committee said users with official access partly added to the data. Review who has access to population-scale records.
-
Tell people
The Ministry said affected citizens would be notified through the e-Government portal. Plan how you will notify at scale.
-
Say what you do not know
Officials said it was premature to confirm before checks ended. A clear status beats a guess.
What to check in your own organization
-
Access to bulk records
Review which staff and partners can export large sets of personal data and log every export.
-
Data lineage
Know which copies of identity data exist in private systems and who holds them.
-
Old leak register
Keep a list of past leaks that include your data and compare new dumps against it.
-
ID number exposure
Treat national ID numbers as high risk; limit where they are stored and shown.
-
Notification plan
Prepare a way to tell large numbers of people whether their data was exposed.
-
Dark web watch
Monitor forums for dumps that mention your organization or country.
-
Legal duties
Check what your personal data law requires after a leak, including inspections and liability.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Kazakhstan Kazakhstan faces fast-growing cybercrime, mostly theft of personal data, and DDoS waves against its national internet and state sites. Asia Pacific
Questions
When did the leak appear?
Information appeared on 16 June 2025 that 16.3 million records with personal data of residents were in open access.
Was a government system hacked?
The Ministry and the Information Security Committee say no. They say the data was outdated, current as of 2022, and came from earlier leaks.
What data was in the file?
Reported fields include name, sex, date of birth, IIN, address and phone numbers.
Who is investigating?
A criminal case was opened and the Ministry of Internal Affairs says the National Security Committee is investigating.
Will people be told?
The Ministry said citizens found in the database will be notified through their e-Government portal account.
Sources
- What We Know about Data Leak Affecting 16 Million Kazakh Citizens (29 July 2025) The Astana Times
- Утечка данных 16 миллионов казахстанцев: Минцифры сделало заявление (17 June 2025) Tengrinews.kz
- Data leak: Kazakhstan citizens will receive notification via eGov (17 June 2025) Tengrinews.kz
- КНБ расследует утечку данных 16 миллионов казахстанцев (30 July 2025) Tengrinews.kz
- Kazakhstan detains over 140 for allegedly selling citizens' data via Telegram channels (9 June 2025, separate case a week earlier, extracted from government databases) The Record
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.