Attackers extracted personal data tied to about 750,000 national identification numbers from Moldova’s government digital services in a cyberattack that ran from October 19 to October 23, 2026, according to the country’s Electronic Governance Agency (AGE). The incident forced authorities to take dozens of public services offline, and Prime Minister Vasile Tofan says investigators are examining whether foreign state actors were involved.
The exposed data may include family relationships, disability and pension records, driver’s license details, photographs and bank account numbers (IBANs). In a country of about 2.4 million people, 750,000 is a number equal to roughly 3 in 10 residents, though authorities say not every person had every data type exposed.
One million ID numbers queried
In an update published on October 27, AGE said preliminary findings show that about 1 million IDNPs, Moldova’s personal identification numbers, were queried between October 19 and 23 in attempts to pull personal data. Data sets linked to about 750,000 of those numbers were extracted.
Government spokesperson Dumitru Ciorici said earlier that authorities had recorded about 11 million access requests aimed at unlawfully obtaining personal data.
Speaking at a government meeting on October 28, Tofan clarified the scale. “This does not mean that 750,000 accounts were hacked. It means that, in 750,000 cases, at least one data element (the first name, last name, year of birth, or at least one such element) was extracted,” he said, according to the state news agency Moldpres.
What data was taken
AGE says the extracted information may include:
- Identification data, including names, dates of birth and places of birth
- Details about first-degree family members
- Health insurance status and assigned family doctor
- Social benefits, pensions and disability records
- Driver’s license details and photographs
- Vehicles and companies owned or managed
- Financial information, including IBANs, tax debts and payment history on the MPay government payments platform
The agency stresses that not every affected person had all of these categories exposed. It says bank card data was not affected, because card payments made through MPay and the EVO government app are processed by banks and the government platform does not store card details. Investigators have found no unauthorized changes to data in state registers.
How the attack worked
According to AGE, the attackers exploited vulnerabilities in government services that could be accessed without authentication. They then used the data they collected to run further extractions from connected systems.
The first attacks targeted an electronic service that recorded the wrong legal basis when it processed data. Because of that error, some citizens saw entries in the data access history of the EVO app showing their data being processed for civil status document requests or driver’s license services.
Tofan said the attackers automated the extraction and that some of the flaws might have stayed hidden under normal circumstances. He said artificial intelligence allegedly helped the attackers find and exploit them. “We must acknowledge that some systems had these vulnerabilities, and our responsibility is to fix them and prevent the incident from happening again,” he said.
Services taken offline
AGE says unauthorized data extraction was stopped at 11:30 a.m. on October 23. That day, authorities inspected 82 digital public services and disconnected the ones at risk, along with more than 30 information systems and administration panels.
The attack did not end there. AGE says a new forced-access attempt was blocked at about 2:00 a.m. on October 25, and further extraction attempts at about 7:00 a.m. on October 27 failed.
The shutdowns disrupted online requests for urban planning certificates, export phytosanitary certificates, medicine import authorizations, food safety registrations and other permits. AGE says most affected services have been fixed and will return once their security is reconfirmed.
Possible foreign involvement
“Our country is the target of coordinated and large-scale cyberattacks. We are not talking about an isolated incident,” Tofan said on October 28. He added that the relevant services are investigating the possible involvement of foreign state actors and that cybersecurity must be treated as a national security issue.
Moldovan authorities have not publicly attributed the attack to any country or hacking group. The Cybersecurity Agency (ASC), the Information Technology and Cybersecurity Service (STISC), the Intelligence and Security Service (SIS) and AGE are investigating. The National Center for Personal Data Protection and the police cybercrime unit have also been notified. Tofan said Moldovan IT company Orange Systems is providing technical help free of charge.
Fraud warning for citizens
Officials say the main risk now is fraud. Criminals may pose as bank or government staff and cite a person’s name or IDNP to gain trust before asking for passwords, authentication codes or payments. AGE urges citizens not to share codes, not to open unsolicited links and to verify any unusual request by contacting the institution or bank directly. It also warns about urgent calls or messages that claim a family member is in trouble or has a new phone number.
Government systems have become frequent targets this year, from the FBI jobs portal cyberattack to the attack that disrupted US bankruptcy court notifications. BreachNews will update this article if Moldova attributes the attack or confirms the final number of affected people.
