Cyberattack exposes data of about 450,000 Moldovans, nearly a quarter of population

What the authorities disclosed

Moldova's president, Maia Sandu, confirmed at a televised press conference on Friday, 6 November 2026, that a cyberattack had exposed personal, financial and medical data of about 450,000 citizens. The country has 2.4 million inhabitants, so the figure affects close to a quarter of the population. Sandu warned that those affected could be targeted by phone scams, fraudulent messages and identity theft. According to preliminary data from the Electronic Governance Agency (AGE), the attackers made about 11 million access requests and queried roughly one million personal identification numbers. The intrusion targeted the computer systems of the state administration that the agency runs.

Timeline of the intrusion

The intrusion took place between 19 and 23 October, and 20 October was the day of greatest activity. Institutions began blocking the attackers' access on 23 October, and the attacks stopped a day later. Sandu acknowledged that state institutions took time to detect the theft. Reports also say the state's response was slowed by the lack of a communication protocol between institutions.

How the system was breached

Sandu described the cause as structural and tied to governance. The systems checked only the application requesting data, not the identity of the user or whether that user had the right to access it, so a single application with faulty access opened the records of at least ten institutions. Once inside, the attackers used a set of personal identification numbers (IDNP) to extract data, then used that data to push further and pull complete files, according to Deutsche Welle's account of her remarks. Sandu also described the architecture as obsolete, and linked the speed of the breach to new technology:

“The speed at which information technologies are developing, especially artificial intelligence, allows malicious actors to find vulnerabilities and exploit them very quickly.”

She also said the attack would not have been possible a year earlier.

Response and next steps

Sandu convened the National Security Council on Friday to discuss the vulnerabilities. The government has taken provisional measures to secure its systems, and a working group set up by the government and led by Prime Minister Vasile Tofan has one month to design long-term protection mechanisms. Some of the solutions identified are confidential so that attackers cannot exploit them. The AGE is to notify each affected person individually, and banks are to be informed about the people whose data was accessed. The government told EL PAÍS that the magnitude of the incident remains significant.

Sandu said banking data was not used to access citizens' accounts, but asked people to stay alert to any suspicious communication. Mediafax reported that IBAN codes were among the information accessed, which criminals could combine with other personal data to win victims' trust by posing as bank or public institution staff. Authorities advise citizens not to give passwords, authentication codes or confidential banking information by phone or message.

Revised figures and wider context

Initial official estimates had put the number of affected people at about 750,000, while the latest figure is about 450,000. The data was accessed through the state's own registers, which the attackers reached from a single access point.

Initial official estimate750,000

Latest estimate (6 November 2026)450,000

Initial official estimate

750000 people

Latest estimate (6 November 2026)

450000 people

Data from the article text

Sandu's announcement came as Europe faced other cyber incidents, including the theft of cryptocurrency from the Binance platform and remote manipulation of industrial refrigeration systems at supermarkets, shops and blood banks.