Attackers broke into Moldova's government digital infrastructure and pulled personal data on about 750,000 people. That is roughly a third of the country's 2.35 million residents. To contain the breach, Moldova's Electronic Governance Agency (AGE) disconnected 82 public services and more than 30 information systems and administration panels. The figures come from the country's Information Technology and Cyber Security Service (STISC), as reported by the state news agency MOLDPRES. Risky Bulletin calls it one of the worst cybersecurity incidents Moldova has suffered. Prime Minister Vasile Tofan has acknowledged the breach publicly. No one has said who is behind it.
What Happened
STISC says the attackers queried about one million state identification numbers (IDNPs) between October 19 and October 23, and successfully extracted data linked to about 750,000 of them. Accounts differ on when the attack was spotted. Radio Moldova and UA News, the latter cited by DataBreaches.net and Breach Signal, say monitoring systems detected unusual activity on the night of October 22. Risky Bulletin puts detection on Friday, October 23, when IT staff saw data leaving the network. Either way, STISC's timeline shows the attackers were active for several days before anyone noticed.
Radio Moldova says monitoring flagged "a suspicious number of database queries", and government systems recorded about 11 million access requests during the attack. STISC says the extraction was stopped at 11:30 a.m. on October 23. AGE then took the exposed services offline the same day.
The attackers came back. STISC says specialists blocked a new attempt to access more government services at around 2:00 a.m. on October 25, and that further extraction attempts at around 7:00 a.m. on October 27 failed. Moldova's police and the National Center for Personal Data Protection are investigating.
Reports differ on how far restoration has got. Logos Press says most affected services are already back online. STISC says most have been fixed but will only return once security checks are reconfirmed. Tofan said services that cannot be restored safely will stay offline. Risky Bulletin notes this is Moldova's second major government breach this year, after a healthcare database was compromised in April.
What Was Taken
STISC and AGE list the following categories of data that were, or may have been, extracted:
- Identity data: full names, dates and places of birth, photographs
- Details of first-degree family members
- Health insurance status and family doctor registration
- Social benefits, pension and disability records
- Driving licence data and vehicle ownership
- Companies owned or managed
- Financial data: IBANs, tax debts and payment history through MPay, the government payment portal
Officials say not every person had every category exposed, and that the exact scope is still being audited. Official wording is also inconsistent. STISC's statement and early coverage say the data "may have been" extracted, while Logos Press and Risky Bulletin, citing AGE, describe it as stolen. Authorities say bank card data was not compromised and they have found no unauthorised changes to state registers. They also point out that knowing someone's IBAN alone does not let anyone get into their account.
Why It Matters
Taken together, this is a profile of a third of the country: who people are, who their relatives are, their health and disability status, their income and benefits, what they own, and what they owe. Authorities say the main risks are fraud and online manipulation. Radio Moldova reports official warnings that scammers may pose as government or bank staff and quote a victim's name or IDNP to sound legitimate. Because the records include details of family members, the data can also feed social engineering against relatives, as well as targeting of officials and their families.
Tofan framed the incident as part of years of hybrid attacks on Moldova. He warned that such attacks will become more frequent, partly because AI can help attackers find vulnerabilities. He did not name a state or group, and no attribution has been published. The repeated attempts to get back in after the attackers were evicted show a persistent, determined actor.
For defenders, the lesson is that a centralised e-government layer creates a single place where data from many registries can be pulled at once. Logos Press also reports a side effect: because the legal basis for data processing was recorded incorrectly, EVO app users could see the attackers' queries in their own access history, listed as requests for civil status documents or driving licence renewals. That shows audit logs can mislead citizens as well as defenders.
The Attack Technique
Officials have only described the way in at a high level. Logos Press, citing preliminary findings, says the attackers exploited vulnerabilities in "certain services accessible without authentication." Risky Bulletin is more specific: it says the way in was a logging service left exposed online without authentication. No official statement in the coverage confirms that detail, and no CVE or vendor product has been named.
The pattern is clear even without those specifics. Huge numbers of automated queries (about 11 million requests covering about one million IDNPs) hit endpoints that handed back registry data without enough access control. In effect, the attackers scraped the government's own systems, which pull together data from multiple registries, for several days. STISC says the affected institutions have received technical recommendations to fix the vulnerabilities.
What Organizations Should Do
- Find every endpoint that needs no login. List every internet-facing service, especially logging, monitoring and debug interfaces, and check whether it returns data or reaches back-end systems without authentication. Remove or lock down anything that does.
- Rate-limit and alert on bulk lookups. If a system can return records by national ID or a similar key, set per-client query limits and alert when one client looks up thousands of distinct identifiers. A run of a million IDNP lookups over several days should not go unnoticed.
- Limit what each query returns. Services that combine data from several registries should return only the fields the caller needs, so that one compromised endpoint cannot hand over a full citizen profile.
- Expect the attacker to come back. After evicting an intruder, increase monitoring for at least several weeks, rotate credentials and keys, and bring services back only after independent checks, as Moldova is doing.
- Get fraud warnings out early. Where national ID and financial data has leaked, tell affected people quickly and specifically: officials will not ask for passwords or one-time codes, and a caller knowing your details does not prove who they are.
- Make access logs accurate. Record the correct purpose and legal basis for every data access, so that citizen-facing access histories and internal forensics match what actually happened.
Sources: Moldova takes down 80+ public services after cyberattack | Moldova Issues Warning About New Cyberattacks Following a Data Brea... | STISC: Personal data of around 750,000 people may have been extract... | Cyberattack on government platforms targets citizens' personal data | Moldova Cyberattack Exposes Data Linked to 750,000 People | Moldovan Prime Minister Says Cybersecurity Will Remain a Government... | Large-scale cyberattack in the Republic of Moldova. Personal data a... | Moldova warns of data breach affecting 750,000 people