Cyberattack on Moldova's government systems exposes data of about 750,000 citizens

What was taken

The Agency for Electronic Governance (AGE) said on Wednesday, 28 October 2026, that data linked to about 750,000 personal identification numbers (IDNP) had been extracted without authorisation from government information systems. According to the agency, the attackers had targeted roughly one million IDNPs between 19 and 23 October. The stolen material reportedly includes names, dates and places of birth, data on first-degree relatives, insurance status, family doctor, social benefits, pensions, disability status, driving licences, photographs, vehicles and companies owned or managed by the person. Financial records were also reached, including IBAN codes, tax debts and payment history on the MPay system. AGE said bank card data was not affected, and the country has about 2.4 million residents.

Targeted (approximately)1,000,000

Extracted (about)750,000

Targeted (approximately)

1000000 IDNPs

Extracted (about)

750000 IDNPs

Data from the article text

How the attack unfolded

The agencies named the night of 22 October as the start of the attack, while the extraction window ran from 19 to 23 October. On 23 October the authorities disconnected 82 public digital services and more than 30 information systems, and extraction stopped at 11:30 that day. A preliminary investigation found that the attackers had exploited weaknesses in services that could be reached without authentication, then used the data they obtained to pull more. Later forced-access attempts around 02:00 on 25 October and around 07:00 on 27 October were blocked. The cybersecurity service STICS recorded about 11 million unauthorised access requests. Several users reported account activity they did not recognise in the EVO app, with one citing an access logged at 23:04 on 21 October. Full restoration of services was completed on the morning of 27 October.

Government response

President Maia Sandu convened the National Security Council to assess the attack and set countermeasures, with the sitting to take place in the days following 28 October, the presidency announced on the evening of 28 October. Prime Minister Vasile Tofan announced that the head of AGE, Nicoleta Colomeeț, had been dismissed, and asked the agency to give greater attention to the security of digital services. Deutsche Welle reported that she had resigned after the agency presented its findings on 27 October, a move agreed with the prime minister. Tofan said authorities had indications of a wider campaign involving foreign state actors and that investigators were examining their role, without naming any country. He also said Denmark, France and South Korea had been targeted by attacks during October. A security expert quoted by HotNews said the working hypothesis is the Russian Federation.

Risks for citizens

Serghei Diaconu, director of the National Crisis Management Centre, said the extracted data cannot be used directly for crimes but could help scammers posing as staff of banks, customs or other bodies. Using real names and personal details would make calls and messages look credible, and fraudsters could then seek additional data, which Diaconu warned could create serious risks for those affected. Analyst Ion Tăbârță said the attack exposed weaknesses in the state's digital security and warned of phishing by phone, SMS and social networks. He stressed that data theft does not automatically mean access to bank accounts.

“Our digital security system is not as well developed as was believed or as the impression given.”

Cybersecurity expert Natalia Spînu said the attack also weakens public trust in state institutions. She called for investment in specialists, clear procedures and individual notification of the people affected. Citing public information, she said about 15 specialists reportedly defended the systems during the incident, a number she considered too small for the country to rely on.