On April 1, Kazakhstan’s Ministry of Digital and Space disclosed the investigation findings on the personal data leak that was reported in February, QazMonitor reports citing the Ministry’s press service.
What happened: The Ministry of Digital Development, Innovations and Aerospace Industry, in collaboration with the National Security Committee and State Technical Service, conducted an unscheduled audit to assess the information security status of telecom operator Kazakhtelecom, the Unified Accumulative Pension Fund, and flight carrier Air Astana.
Kazakhtelecom and Air Astana have been brought to administrative responsibility under paragraph 2 of paragraph 1 of Article 641 of the Code of the Republic of Kazakhstan "On Administrative Offenses". Both companies have been directed to rectify the identified violations within one year.
The penalty for such offenses for large companies amounts to 100 Monthly Calculation Indexes, or ₸369,200. As of April 1, 2024, this amounts to approximately $826.
The Ministry clarified that no violations were detected in the Unified Accumulative Pension Fund.
The information and communication infrastructure of these organizations is currently under round-the-clock monitoring to promptly identify and mitigate information security incidents.
Background: On February 16, 2024, materials by one of the hacker groups were anonymously published on GitHub, containing personal data of Kazakh citizens spanning 2019–2022. The disclosed data included information on Kazakh telecom operators with details about subscribers and specifically mentioned Kazakhtelecom, the Unified Accumulative Pension Fund, and Air Astana.