Pakistani Hacker Group Exposes Data of Over 600,000 Kyrgyz Citizens
A Pakistani hacker group, Team Insane Pakistan, has published the personal data of more than 600,000 individuals and legal entities in Kyrgyzstan. They claimed this was in retaliation for attacks on foreign citizens in Bishkek on May 18.
The hackers announced the data breach on their social media pages on May 22. Journalists from Kaktus.Media discovered that the leaked data closely resembles a database that was exposed in 2020.
When questioned by journalists from Radio Liberty’s Kyrgyz service, the hackers claimed to have accessed the data by hacking a subdomain of the gov.kg website and obtaining information from the Supreme Court. However, this claim was denied by the court.
The leaked database includes full names, dates of birth, tax identification numbers, and addresses. Journalists found that it contains both outdated and current information about Kyrgyz citizens and companies. Notable figures in the database include Kamchybek Tashiev, head of the State Committee for National Security; Nurlanbek Shakiev, Speaker of the Jogorku Kenesh; and Edil Baysalov, Deputy Prime Minister.
An anonymous member of Team Insane Pakistan told Radio Liberty that the data was obtained through a successful hacking operation and is not available from open sources. They claimed, “This database is not available on the open Internet. We hacked a subdomain of the gov.kg website and exploited an SQL vulnerability to obtain the data of more than 500,000 Kyrgyz citizens. These people are targeting our Pakistani brothers. If they do not stop their attacks, we will release even more data. All gov.kg websites are vulnerable.”
Riin Alyas, a journalist specializing in digital forensics at Radio Liberty/Azattyk, estimated that the leaked database contains at least 523,594 unique tax identification numbers (TINs) out of more than 630,000 entries. The list also includes entities without a TIN.
Kaktus.Media noted that in 2020, data of over 800,000 taxpayers in Kyrgyzstan was made publicly available. After comparing the two datasets, they concluded that the information is almost identical. The main difference is that the 2020 database was organized and numbered, while the data leaked by Team Insane Pakistan is scattered and unnumbered.
