Personal data belonging to 529 employees across seven educational institutions in Shieli district was exposed on the state public procurement portal. The sensitive files were uploaded alongside tender documents for procuring occupational health checkups. Following intervention by the regional prosecutor’s office, the records were removed.
The Kyzylorda Regional Prosecutor’s Office disclosed the incident on October 3. Regulatory infractions were identified by district prosecutors during supervisory audits. The heads of the responsible institutions were subjected to administrative disciplinary penalties.
Personal Data Leaked Through Tender Attachments
According to prosecutors, the source of the data leak was documentation published by the educational institutions themselves. The oversight authority reported no server breaches or external database exfiltration. The standard public tender workflow inadvertently became the distribution channel for personnel records.
The specific scope of exposed data fields was not detailed in the official press release. Consequently, one cannot definitively assert whether national identification numbers (IIN), home addresses, clinical diagnoses, or medical exam findings were included. The administrative association with healthcare procurement does not independently confirm the release of medical records.
The specific seven institutions and the exact duration the attachments remained publicly downloadable were likewise omitted. The prosecutor’s office presented no evidence that the exposed information was accessed or exploited by malicious actors. The figure 529 represents educational sector employees generally; characterizing all affected individuals as teachers is unverified.
Why File Deletion and Data Protection Are Distinct Tasks
Deleting a file restricts future public downloads from the portal. However, confirmation of retroactive removal cannot determine whether third parties downloaded the files during the exposure window. Answering that question requires web server access logs not included in the public briefing.
The episode highlights systemic flaws in tender preparation workflows: organizational service requirements must be strictly bifurcated from identifiable individual personnel data. Document sanitization must be built into procurement processes, as private records typically reside within attached spreadsheets rather than public tender titles.
Automated Data Redaction Tools Under Development in Kazakhstan
Days prior to this incident, RAEM.KZ reported on Qupia, an AI tool developed by ISSAI at Nazarbayev University. The software is engineered to detect and redact personally identifiable information (PII) across text documents, images, and audio files.
A critical caveat regarding Qupia is its current prototype status. The development team cautions that automated models may experience recognition omissions and explicitly advises against uploading production confidential files. Consequently, the utility cannot yet serve as a certified compliance guarantee for procurement workflows.
No evidence indicates that Qupia was deployed within the Shieli district institutions. The convergence between the two developments lies in the underlying institutional imperative: scrubbing private data before public distribution. In the incident involving 529 staff, automated screening should have occurred prior to portal upload.
