Kazakhstan Probes inDrive, Kinopark, Lucem Data Leak
In short: On October 15, 2026, Kazakhstan's Ministry of Artificial Intelligence and Digital Development said it had accepted for review information about a possible data leak affecting customers of three unrelated companies: ride-hailing service inDrive, cinema chain Kinopark, and Lucem Medical Clinic. Evidence of the leak was sent to the Telegram channel egovpress; the dataset reportedly includes names, birth dates, phone numbers, emails, spending on services, cinema session details, and scheduled medical appointment records. Three companies from unrelated industries showing up in a single dataset is a classic sign that this personal data leak originated not from the services themselves, but from a shared intermediary handling their data.
What happened
Between October 13 and 15, 2026, material purporting to confirm a leaked database of inDrive, Kinopark, and Lucem Medical Clinic customers surfaced on the Telegram channel egovpress. On October 15, Kazakhstan's Ministry of Artificial Intelligence and Digital Development officially confirmed it had accepted the information for review and announced it would investigate all three organizations. As of publication, none of the companies had publicly confirmed a breach on their end — the investigation is ongoing, and the source and scope of the incident remain officially unconfirmed.
What data may have been exposed
According to descriptions of the leaked dataset, it includes customers' names, dates of birth, phone numbers and email addresses, plus service-specific details: spending on services (likely tied to inDrive), cinema session attendance (Kinopark), and scheduled medical examination records (Lucem). This isn't just identifying information — it reveals real behavioral patterns: where people travel, what they watch, and when they see a doctor.
Why three unrelated services in one leak isn't a coincidence
Ride-hailing, entertainment, and healthcare are industries with completely different infrastructure and security teams. If data from all three ended up in a single dump at once, the most likely explanation is a shared third-party vendor, analytics platform, or data broker that processes or shares customer data on their behalf. It's the same risk class seen in several recent high-profile government registry breaches: a core service's security is worthless if a weaker intermediary with access to its data gets compromised instead.
What this means for users — not just in Kazakhstan
inDrive is an international service used across Russia and other CIS countries, so the fallout from a potential leak isn't confined to one country. A combination of "name + phone + email + birth date + spending/visit history" is ready-made material for targeted phishing: a scammer who can cite the exact amount of your last ride or the date of your medical appointment sounds far more convincing than an anonymous caller. Until the investigation concludes, it's reasonable to treat the risk as real even without official confirmation from the companies themselves.
What to do if you use these services
- Change your password in the inDrive app, your Kinopark account, and your Lucem account, especially if it's reused elsewhere.
- Enable two-factor authentication wherever available — it won't undo a database leak, but it stops stolen contact details alone from being enough to log in.
- Be wary of calls and texts that cite exact details of a ride, a cinema session, or a doctor's appointment — after a leak like this, that's no longer proof of authenticity; it may mean the caller is working from stolen data.
- Don't click links in messages "from inDrive," "from Kinopark," or "from the clinic" asking you to confirm payment details or a card number.
Where a VPN fits in
If confirmed, this breach happened on the companies' or a vendor's servers, and a VPN cannot prevent someone else's database from being hacked. But a VPN covers an adjacent risk: when targeted phishing emails and texts start arriving with links to fake "confirm your data" pages after incidents like this, an IP address masked through LiMP VPN keeps a click on such a link from being tied to your real location and ISP. It's not protection against the leak itself, but an extra layer that limits the data available for further profiling.
FAQ
A few quick answers to the questions this kind of multi-company leak claim usually raises while the investigation is still ongoing.
Sources
Frequently asked questions
Have inDrive, Kinopark and Lucem officially confirmed the leak?
Not as of publication. Kazakhstan's digital ministry accepted the information for review on October 15, 2026, but none of the three companies has publicly confirmed a compromise of its systems.
Why would data from three unrelated companies end up in one leak?
The most likely explanation is a shared third-party vendor or platform the companies use to process or share customer data. It's a classic supply-chain risk, not a coincidence.
Does this affect users outside Kazakhstan?
inDrive is an international service used in Russia and other CIS countries as well, so the risk of targeted phishing based on leaked data isn't limited to one country.