The BUTTERFLY group has claimed to have discovered vulnerabilities in Uzbekistan's systems

The BUTTERFLY group has claimed to have identified vulnerabilities in Uzbekistan's systems

The hacker group BUTTERFLY reported that it had discovered vulnerabilities in the state information systems of Uzbekistan, including the infrastructure of the former Personalization Agency. At the same time, representatives of the group denied that a database containing information on more than 27 million citizens had actually been leaked online.

Earlier, reports appeared on the Internet claiming that BUTTERFLY had allegedly gained access to the information systems of the former Personalization Agency and possessed a large database of personal data. The group also demanded that state authorities contact them, threatening otherwise to put the database up for sale on the darknet.

To support their claims, members of the group published the personal data of the Minister of Digital Technologies, Sherzod Shermatov. However, according to available information, there is no independent confirmation that the entire database was compromised.

Later, BUTTERFLY published a statement describing itself as a community of ethical hackers. Members of the group claim that they do not pursue destructive goals and want to help increase the level of cybersecurity in the country.

According to them, the previously circulated materials were a warning, not the result of an actual data leak or a malicious breach. The group claimed to have discovered a number of critical vulnerabilities and leaks in state digital platforms, and also accused relevant bodies of paying insufficient attention to the protection of information systems.

Separately, BUTTERFLY members explained that the published information about the Minister of Digital Technologies, according to their statement, was already in open sources and could have been found using OSINT methods. The group also announced its intention to regularly publish information about discovered threats and vulnerabilities.

In its statement, BUTTERFLY also announced plans to recruit new members to its team. Selection conditions are reportedly to be published later.

The structure of the former Personalization Agency, presumably affected by the incident, was transferred to the system of the Ministry of Internal Affairs in January 2026.

At present, the group's statements about the discovered vulnerabilities and possible access to state information systems have not received independent confirmation. The real scale of the incident and the security status of the affected platforms can be established following an investigation by competent authorities.