Summary
- Moldova estimates unauthorised extraction of datasets associated with around 750,000 identification numbers.
- Authorities reviewed 82 services and disconnected exposed services plus more than 30 systems or panels.
- Subsequent access attempts were detected, but authorities say the latest attempts were blocked.
Moldova’s Electronic Governance Agency estimates that attackers extracted sets of personal information associated with about 750,000 personal identification numbers during an intrusion into government digital services. Its preliminary investigation found that approximately one million identification numbers were queried between 19 and 23 October, while authorities are still establishing exactly how many records and people were affected.
The agency says the unauthorised extraction stopped at 11:30 on 23 October. It subsequently checked 82 digital public services and disconnected those considered exposed, alongside more than 30 information systems and administration panels. Further attempts against public systems were blocked on 25 October, and another attempt to extract information on 27 October was unsuccessful. Some affected services had already been repaired when the agency provided its update, with reconnection dependent on further security checks.
The fields identified in the preliminary assessment include names, dates and places of birth, first-degree family relationships, health insurance status, assigned family doctors, social benefits, pensions, disability information, driving licence details, photographs, vehicle records and interests in companies. Certain financial details, including IBANs, tax debts and MPay payment history, also appear among the data categories. The agency explicitly cautions that not every affected person had every category exposed. Separate government registers may hold different subsets of these fields, so establishing the actual exposure requires source-by-source checks before any individual impact can be determined.
An identification number can act as a common reference across government registers. When information is aggregated around that identifier, a criminal who obtains one dataset may be able to correlate it with other material and create a far more detailed picture of an individual than any isolated entry would provide. The immediate risk is not necessarily direct access to a bank account; information about family relationships, payments or public benefits can make attempts to impersonate an institution or deceive a citizen more credible.
Public-service platforms often combine a citizen-facing portal with interfaces that retrieve records from several back-office authorities. A single exposed query mechanism can therefore reveal information held by departments that have otherwise distinct functions. This architecture helps explain why an investigation cannot stop at identifying the first attacked application. Authorities must identify each source of data returned, the permissions under which requests were made and any further credentials that might permit similar queries through another route. The record of unsuccessful later attempts is evidence of continued adversarial interest, not proof that the same method remained available.
Moldova’s statement differentiates service restoration from completion of the forensic investigation. Reconnecting a public portal may require functional tests, security review and confirmation that administrative access has been protected; determining exactly which records were retrieved is a separate process. An information system can be safe to operate again while notification or individual exposure assessments are still under way. The government has identified fraud and manipulation as the principal immediate risks, and the combination of personal, family and financial fields creates opportunities for convincing impersonation even where payment services themselves were not breached.
Approximately one million identifiers were queried, according to the agency; its smaller figure of 750,000 concerns identifiers linked to datasets believed to have been extracted. Neither figure establishes the number of complete individual files removed. An audit will also have to determine which systems supplied which data, whether access continued across different accounts, and which information was reachable through linked services.
Disconnecting interconnected public-service interfaces can block further unauthorised access while interrupting legitimate transactions. Reconnecting those interfaces depends on confirming that the vulnerability or access route has been closed. Moldova’s cybersecurity agency and other competent authorities are investigating the incident. Attribution to a foreign state has not been established publicly, and the final inventory of exposed personal data remains provisional.
