"eGov was not hacked": the ministry refutes a loud leak claim — but the lesson stands

Kazakhstan's ministry of digital development refuted loud reports of a leak of citizens' data through eGov: the review found the portal was not hacked, and the dataset circulating online is a compilation of old leaks from third-party sources dressed up as a fresh breach of the state system. The panic, however, had already spread widely.

This story is a textbook on the anatomy of a security news cycle. Selling old data as a "fresh eGov hack" benefits everyone except the truth: sellers get a higher price, channels get reach. The refutation always chases the rumor late and never gathers as many views. Yet the compilation itself is no fiction: data leaked once never disappears — it gets resold for years in new wrappers.

There are two practical layers here for a company. The reputational one: prepare a plan for the day "you've been hacked" is published before you know anything. Who verifies, who answers publicly and where, how fast you can tell a real incident from a compilation — those hours decide everything. The human one: your employees' data is almost certainly in old leaks, so passwords must not repeat across services, and access to work systems must require a second factor. Then other people's old leaks won't become your new problem.