The Moldovan government is currently examining whether foreign state actors were involved in a significant cyberattack against its governmental apparatus, an incident that resulted in the exposure of sensitive personal details and the interruption of numerous public services, as stated by the nation's prime minister on Wednesday. Prime Minister Vasile Tofan indicated that this event might be connected to an extensive campaign specifically targeting both the personal data of citizens and the nation's digital infrastructure, according to reports from domestic media outlets. Tofan asserted that "Our country is the target of coordinated and large-scale cyberattacks. We are not talking about an isolated incident," while also noting that authorities were investigating the potential involvement of external state actors. Moldova has refrained from officially assigning the attack to any specific nation or hacking collective.
This statement from Tofan followed a day after Moldova's Electronic Governance Agency (AGE) revealed that malicious actors had exploited weaknesses within government services to pull out substantial quantities of private information between October 19 and October 23. The perpetrators executed roughly 11 million requests to access data through these governmental platforms. Preliminary assessments suggest that data pertaining to around 750,000 identification numbers was successfully extracted, although it was noted that not every affected individual had every category of personal data compromised. The data that was compromised could encompass details such as names, dates and locations of birth, familial ties, health insurance standing, social benefit entitlements, pension details, disability records, driver's licenses, photographs, and particulars of vehicle ownership. Furthermore, the agency indicated that financial details, including tax liabilities, bank account numbers, and government payment histories, might have been accessed. Authorities confirmed that information related to bank cards remained secure, and investigators found no evidence suggesting that official government records had been tampered with.
The agency explained that the hackers leveraged security flaws in services that did not necessitate authentication, subsequently using the gathered data to pull additional information from linked government systems. In response to this breach, authorities conducted inspections of 82 digital public services and temporarily severed connections to those deemed susceptible, alongside more than 30 administrative panels and government information systems. These service interruptions impacted various public functions, including the online submission of construction permits, authorizations for veterinary transport, registrations for food safety, and imports of medical supplies, according to local media accounts. The agency reported that the majority of the affected services have since been secured, and access is being progressively reinstated following supplementary security evaluations. Authorities further advised that while unauthorized access was blocked on October 23, subsequent attempts to penetrate government services were detected on Sunday and Tuesday, both of which were unsuccessful. The government issued a warning that the stolen data presents a risk, as it could be utilized in fraudulent schemes, such as impersonating public bodies or financial institutions to procure passwords, authentication codes, or funds.
Government spokesperson Dumitru Ciorici suggested that this incident might be a component of a wider campaign involving hybrid attacks directed at Moldova. The nation, which contains approximately 2.4 million inhabitants and shares borders with Ukraine and Romania, has experienced recurrent cyberattacks and influence operations since Russia initiated its full-scale invasion of Ukraine in 2022. Moldovan authorities have previously leveled accusations against Russia, claiming it is conducting destabilization efforts intended to weaken state institutions and erode public trust in the government led by President Maia Sandu, which supports European integration.
The ongoing situation reflects a broader trend where state and non-state actors are increasingly utilizing cyber vectors to pressure sovereign entities, as evidenced by the repeated targeting of Moldovan digital infrastructure.
Why it matters
This incident highlights the ongoing threat of state-sponsored campaigns targeting critical national digital infrastructure. For platform operators, this underscores the severe risk posed by vulnerabilities in public-facing, unauthenticated services. Readers should watch for further attribution as authorities investigate the scope of this coordinated attack.
