2025 Kazakhstan ~16.3M-person national PII leak (private-system compilation); fintech/banking customers caught in nationwide identity ecosystem response
Data compromised
Names, DOB, IIN, phones, addresses, citizenship/residency metadata per regulator/news summaries
Technical writeup
From mid‑2025, Kazakhstan investigated a mass personal-data leak (~16.3M people) containing IIN-linked demographic contact fields; authorities described sources as largely private information systems and historically compiled datasets rather than a single “government census.db” exfiltration. Kaspi.kz is not uniformly named as the originating custodian in public ministry statements, but as a dominant retail/fintech platform the incident sits in the same national ID and fraud‑mitigation response orbit tracked for major FI customers.
Root cause
Large-scale compromise or aggregation of privately held citizen datasets (exact multi-tenant path under criminal investigation)