National Security Council approves measures to strengthen cybersecurity of Moldova

The National Security Council (NSC), convened today by President Maia Sandu, examined the circumstances of the massive cyberattack on governmental information systems that occurred in October 2026 and agreed on a set of measures to strengthen cybersecurity, protect citizens' data and modernize the state's digital infrastructure.

According to the assessments presented during the meeting, the cyberattack targeted infrastructure administered by the Electronic Governance Agency (AGE), affecting more digital services. The attackers exploited vulnerabilities in authentication and access control systems, managing to access data from the registers of at least ten public institutions.

The attack began on the evening of October 19, and on October 20 approximately one million automated requests to government systems were recorded—30 times more than the usual average. On the same day, more than 260,000 records concerning family relationships were extracted. Starting from October 21, the institutions intervened to limit data extraction, and by October 24 the attacks had been blocked. Subsequent attempts to gain unauthorized access were also rejected.

According to the latest assessments, the personal data of approximately 450,000 citizens was accessed, a number lower than figures previously reported. The affected individuals will be notified by the Electronic Governance Agency.

The participants in the meeting examined both the technical and institutional vulnerabilities that allowed the incident to occur and the measures taken to stop the attack. AGE remedied the problems identified in the MPass authentication service, introduced additional checks concerning the right to access data and strengthened the security mechanisms of governmental platforms.

President Maia Sandu emphasized that the incident had also highlighted coordination and communication deficiencies among the competent institutions. The problem was detected late and the institutional response was not sufficiently coordinated. At the same time, public communication did not address all citizens' concerns, making clear intervention and communication procedures necessary in such situations.

Following the meeting, the National Security Council agreed on six priority areas for action:

1. Establishing a working group led by the Prime Minister which, within one month, will propose systemic solutions to address the identified vulnerabilities and strengthen cybersecurity, including in the context of risks associated with the development of artificial intelligence. Progress will be assessed at a new NSC meeting in three months.

2. Modernizing the architecture of the state's information systems, in order to ensure stricter control over access to data and a uniform, secure digital infrastructure. Particular attention will be paid to replacing outdated systems and establishing clear service-life limits for them.

3. Reforming public procurement in the field of information technology, including through legislative amendments, in order to prioritize quality standards, select trusted providers and hold them accountable for the security of the systems they develop.

4. Introducing clear rules for the entire life cycle of information systems, from development and testing to operation, maintenance and periodic risk assessment. Systems that no longer meet security requirements will have to be replaced.

5. Clarifying institutional responsibilities in the field of information technology. The government will develop proposals to delineate the competencies of the responsible institutions, eliminate overlapping mandates and ensure rapid and effective coordination in the event of incidents.

6. Strengthening cybersecurity mechanisms through periodic testing, updates, continuous 24/7 monitoring, anomaly detection and the rapid remediation of vulnerabilities, including with the help of artificial intelligence-based tools.

A separate topic discussed at the meeting concerned protecting citizens against fraud attempts that could use the personal data extracted during the attack.

The head of state said that the incident had not affected the integrity of banking data and that possession of an IBAN code does not, by itself, allow access to bank accounts. However, the personal data got illegally could be used in fraud attempts, including calls or messages in which attackers pose as representatives of banks or public institutions. Banks will be informed about the individuals whose data was accessed, in order to carry out additional checks in the event of potential transactions initiated in their names.

Citizens are urged not to disclose passwords, PIN codes or card details by phone or SMS and to verify any suspicious request by directly contacting the institutions concerned through official channels. Individuals who suspect fraud attempts or need information about their personal data can use the contact channels provided by AGE. For immediate assistance, citizens are urged to call 112.

To strengthen digital education, the responsible institutions, including the Education Ministry, will prepare a model lesson for middle and high school students, focused on protecting personal data and preventing online fraud. At the same time, the National Crisis Management Center, in cooperation with the Cybersecurity Agency, will prepare a practical digital security guide for citizens.

President Maia Sandu warned that cyberattacks represented an increasingly serious threat to national security, amid the rapid development of information technologies and the use of artificial intelligence to identify and exploit vulnerabilities.

The head of state stressed the need for investment in cybersecurity, the modernization of digital infrastructure and public education, so that institutions can prevent, identify and manage incidents more effectively.

At the same time, the President emphasized that Moldova must continue the process of digitalization and the development of electronic public services, while strengthening their security.

"We must not abandon digitalization and the use of digital services, especially in a small country like Moldova. Digitalization is the path toward greater efficiency, as well as toward improving access to public services," President Maia Sandu said.