eGov Mobile investigates security after user reports accessing stranger's account

AI digestMimile.ai EditorialAugust 4, 2026 at 10:17 AM

This digest was compiled by AI from multiple sources — links to the originals are below.

eGov Mobile investigates security after user reports accessing stranger's account

eGov Mobile, Kazakhstan’s electronic government platform, is investigating a potential security breach after a user reported accessing another person’s personal cabinet on August 4. Sherkhan Qairatuly used QR code login on eGov Mobile but was shown the account of Balkhan Askar, displaying personal service history including medical services and loan rejection. The platform has launched a probe and promised to provide feedback, even as other users shared similar experiences on social media.

The Incident

Sherkhan Qairatuly reported on Threads that a QR code login to eGov Mobile redirected him to the personal cabinet of Balkhan Askar. The cabinet showed Askar’s service history, including medical appointments, a payment, and a bank loan rejection — none initiated by Qairatuly. The user expressed concern that security measures appeared to have failed. The report quickly spread on social media, with users questioning the platform’s reliability.

Platform Response

eGov.kz responded to the user’s post, stating it had forwarded the information to specialists for verification. The electronic government department assured that it would provide feedback after the investigation. No timeline for the probe was given. The response did not address whether similar incidents had been reported previously.

User Reactions

Multiple users shared their own experiences of accessing unfamiliar accounts on eGov Mobile. One user described a past case where she briefly saw someone else’s data and logged out in fear. Another recounted that she and her husband found unknown children registered under their profiles. The recurrence of such episodes has intensified skepticism about data protection standards on the platform.

What's Next

The eGov Mobile team will report the results of its investigation, and it may recommend security enhancements. It remains unclear whether a widespread vulnerability exists or if the incidents result from isolated errors.

1 source

eGov Mobile investigates security after user reports accessing stranger's account

azattyq-ruhy.kz

Azattyq Ryhy

Kazakh resident reports eGov glitch giving access to another user's account

A Kazakhstan resident claimed he logged into another person’s eGov account by scanning a QR code, sparking a security review by the service. The incident, captured on video and shared widely on social media, raises questions about the protection of personal data on the government portal. eGov's press service said it contacted the user and launched an investigation, but did not explain how the breach occurred.

Zoom patches critical account takeover vulnerability

Zoom patched a critical security flaw that could allow an unauthenticated attacker to take over accounts via network access. The bug affects Windows clients and was disclosed alongside three privilege escalation issues. No active exploitation has been reported, according to IDC.

tl;dv AI notetaker vulnerability exposes government and corporate video calls to any user

A vulnerability in AI meeting assistant tl;dv — used by over two million users including Salesforce, Forbes, and dozens of government agencies — allows any user to access meeting metadata and join live video calls, a security researcher has found. Researcher BobDaHacker discovered in January that any logged-in user can query tl;dv’s Google Firestore database to obtain timestamps, creator emails, and join video conferences of other users. The flaw remains unpatched, and tl;dv has not responded to attempted disclosures by the researcher or Dark Reading.

Check Point uncovers OAuth phishing campaign exploiting genuine Microsoft logins, targeting 120+ orgs

Check Point's email research team disclosed a phishing campaign that ran from late June into July 2026, abusing real Microsoft login pages to compromise accounts across over 120 organizations worldwide. The attackers sent fake Microsoft Teams notifications directing victims to a legitimate OAuth authorization URL, then tricked them into approving permissions for a malicious application, granting access to email, files, and messaging platforms without stealing passwords or defeating multi-factor authentication. The tactic eliminates the need for look-alike domains or credential harvesting, underscoring a shift in attacker methods.

eGov Mobile investigates security after user reports accessing stranger's account

The Incident

Platform Response

User Reactions

What's Next

Read more

Read more