Uzbekistan's Minister of Digital Technologies Sherzod Shermatov has called on government agencies and private companies to urgently strengthen personal data protection amid the rapid development of artificial intelligence (AI). The official did not confirm reports of a possible data leak affecting 27 million citizens, but warned outright: there are no guarantees against such incidents.
Such incidents threaten citizens primarily with fraud, and businesses and government agencies with new costs. The minister urges allocating funds for cybersecurity alongside investments in AI. Data protection specialists, by contrast, stand to benefit: demand for them, according to the head of the Ministry of Digital Technologies, will grow.
No guarantees: AI has accelerated the search for vulnerabilities
Shermatov commented on Telegram on a statement by "ethical hackers" from the Butterfly group that information on 27 million citizens may have been made publicly available. The group claims it did not hack anything: its members merely compiled data from past leaks that the authorities had not confirmed, and published the minister's own phone number.
The minister did not confirm the figure cited by the group, but did not rule out new incidents either. "The fact that the leak has not yet spread further does not in any way guarantee that something like this won't happen tomorrow if urgent measures are not taken!" he warned. The head of the Ministry of Digital Technologies also recalled the recent incident with Binance, through which more than $6.3 billion was stolen.
Shermatov believes that AI "has launched a genuine revolution in identifying vulnerabilities in legacy information systems." Since 2020, the number of discovered problems has grown severalfold. Therefore, in his view, investments in artificial intelligence must be accompanied by growing investment in protection against the threats associated with it: "If such expenses are considered misallocated for AI development, the risks will only increase."
The head of the Ministry of Digital Technologies called on all organizations, including state and commercial ones, to constantly search for and promptly eliminate vulnerabilities, allocate additional funds for system protection, and train personnel. He advised specialists to monitor reports from the State Security Service's Cybersecurity Center and the UzCERT service about new problems. Demand for cybersecurity experts, according to the minister's forecast, will grow, so specialized universities should pay attention to this field.
The cost of leaks: fraudsters, fines, and a common CIS center
Members of a fake call center in Tashkent called citizens posing as banks, extracted personal data, stole money from cards, and took out loans in the names of victims. The suspects moved an amount equivalent to $8 million abroad via cryptocurrency, and the group included an employee of one of the banks' cybersecurity departments.
It is precisely banks and the crypto channel that regulators are now placing under enhanced control: on October 13 it became known that the Central Bank of Uzbekistan fined eight banks based on September results for violating regulations and the law. The National Agency for Prospective Projects (NAPP) simultaneously updated the rules for crypto exchanges: client verification can be delegated to specialized organizations, and suspicious transactions must be reported through secure channels.
Money in such schemes often goes abroad, so earlier at the CIS summit, President Shavkat Mirziyoyev proposed creating a common CIS contact center against cross-border cybercrime. According to the head of state, fraud using information technology is already causing serious damage to citizens and businesses and creating risks for the financial systems of CIS countries.
Cryptalist analysis: The Uzbekistan case illustrates an emerging global trend: generative AI lowers the barrier to entry for attackers while simultaneously accelerating audits of legacy infrastructure, exposing vulnerabilities accumulated over the years. For the crypto sector, this is a double signal — tighter KYC procedures and transaction flow controls by regulators are becoming inevitable, and demand for compliance and cybersecurity solutions is turning into an independent investment segment. Market participants should factor reputational and operational risks associated with data leaks into their long-term strategies.