Personal data exposure
The Agency for Electronic Governance reported that a cyberattack on Moldova’s government digital services exposed personal data linked to 750,000 personal identification numbers. This exposure affects about a quarter of the population. The attack occurred between October 19 and October 23, when attackers attempted to obtain information linked to approximately one million identification numbers. The Agency for Electronic Governance stated that while attackers attempted to access information linked to one million identification numbers, the actual unauthorized extraction of data from the government’s systems stopped at 11:30 AM on October 23. The potentially accessed information includes names, dates and places of birth, details of relatives, health insurance, family doctor information, social benefits, pensions, disability records, driving licences, vehicle ownership, and photographs. Information categories varied between individuals. The full set of listed data was not necessarily accessible for every identification number affected. Other potentially exposed data includes international bank account numbers (IBANs), tax debts, and payment histories through the government’s MPay platform.
Agency response and security
Shutting down 82 digital services and more than 30 information systems clearly prevented further breaches. I find the fact that attackers attempted to extract data again on the morning of October 27 quite troubling, although the agency says that attempt was unsuccessful. Specialists blocked another attempt to gain unauthorized access to several government services on October 25.
| Data Category | Security Status |
|---|---|
| Bank card details | Not compromised |
| State registry records | No evidence of changes |
| Real estate/company ownership | No transfer of rights enabled |
| IBANs and tax debts | Potentially exposed |
Most affected services have since resumed, though the Agency for Electronic Governance waits to restore remaining services until authorities reconfirm security effectiveness. The agency said bank card information remained safe because payments through MPay and EVO use secure banking systems, and government platforms do not store card details. I would note that an IBAN alone is insufficient to access a bank account. Investigators found no evidence of unauthorized changes to state registry records, and real estate information access does not enable ownership transfers. The Cybersecurity Agency, the Information Technology and Cybersecurity Service, the Information and Security Service, and the Agency for Electronic Governance continue audits to establish the incident scope.
