Press statements made following meeting of Moldova's National Security Council

The government system of Moldova in October 2026 was targeted by a massive cyberattack. The institutions convened by the National Security Council presented their investigations into the scale of the attack, the attackers’ way of operation, the weaknesses they exploited, the immediate measures taken during those days, as well as medium- and long-term systemic proposals to strengthen the country’s cybersecurity and ensure a higher level of protection for digital governmental services.

More state institutions have already communicated about this incident, but it is important to return to this discussion, so that all citizens know what happened, even if the information may seem too technical to many of them.

What happened:

The incident occurred in infrastructure administered by the Electronic Governance Agency (AGE), affecting more services. The underlying cause was structural and related to governance: the systems verified only the application requesting the data, not the identity of the user or their right to access the data.

Thus, a single application with defective access opened the registers of at least ten institutions. The attacker, having a set of personal identification numbers (IDNPs), entered the system and extracted data, which was subsequently used to gain further access and extract complete files.

The incident was the consequence of an architecture in which data from all registers was accessible through a single point, without control by the data owners and without volume limitations. In addition, there was no automatic alert when a certain extraction threshold was exceeded.

Chronologically, the institutions presented the attack as follows: automated requests from more than 638 IP addresses concealing the real source began on the evening of October 19. The most intense day was October 20, with approximately one million requests in a single day—30 times more than the average. Also on October 20, more than 260,000 pieces of data about relatives were extracted.

On October 21, AGE stopped the exfiltration of data about relatives. As early as October 23, the blocking of the attackers began. On October 24, all attacks were blocked, and the attackers were no longer able to steal data.

The attempts continued, but they were repeatedly blocked by the institutions.

The state institutions’ communication about the incident was delayed and did not address all of the people’s concerns. The lack of a communication protocol for such situations led to uncertainty regarding roles and responses.

The latest assessments show that the data of approximately 450,000 citizens was accessed. This is a lower figure than those circulated in recent days, but it is still a large number. These people will be notified by the Electronic Governance Agency.

What the state institutions have done in the meantime:

The massive attack was stopped. AGE disconnected all electronic services and platforms integrated with MPass, and after the problems were addressed, they were gradually brought back online.

The problems in the authentication and access-control service were resolved. It is now verified that the source requesting the data is the rightful holder of that data. Access points were secured through mandatory authentication and the responses that could be provided were limited to strictly necessary data.

The administrators of all systems integrated with MPass received instructions and an additional verification test that was implemented as an emergency measure.

What citizens need to know:

First of all, the cyberattack did not affect the integrity of banking data. Even if IBAN details were extracted, this information is not sufficient to access your bank accounts. Nevertheless, banks will be informed about the people whose data was accessed, so that they can conduct additional checks, if transactions are initiated in those people’s names.

The risk is that the extracted data could be used in combination—for example, an IDNP together with knowledge of relatives or information from a driving licence, sometimes along with an IBAN, to contact various people for the purpose of fraud. In other words, someone who has access to certain data about you may call or write to you while pretending to be a representative of a bank or the police and ask for additional information.

Dear citizens,

No state institution or bank will request PIN codes, passwords, or card details by telephone or SMS. If you receive such a call, hang up and call the bank or the police directly using the telephone numbers displayed on the institutions’ official websites, not the number from which you were contacted. It is better to refuse a call than to fall victim to fraud.

The Electronic Governance Agency has published telephone numbers and other contact details that citizens can use, if they suspect an attempted fraud or need information about their personal data. For immediate assistance, call 112.

We agreed that the institutions, including the Education Ministry, would prepare a model lesson for middle- and high-school students, explaining more basic rules for protecting personal data, such as avoiding overly simple passwords or using the same password on multiple platforms, changing passwords regularly, activating two-factor authentication for email, social networks and other applications, paying increased attention to suspicious links or free offers and using other technical solutions. We hope that, later, young people will also be able to help their parents be more vigilant and better protected.

The National Council for Media and Communication (CNMC), in cooperation with the Cybersecurity Agency, will also prepare a simple data-protection guide with clearly explained steps for all citizens.

The strength of our cybersecurity depends both on the state’s ability to secure its infrastructure and on each of us being able to protect our own data.

There may also be another risk: people may be unable to access certain services because of the failure or preventive shutdown of some platforms.

One of the most serious consequences is, in fact, the weakening of trust in the state’s cybersecurity and in the safety of digital services. This is precisely where the responsible state institutions must act immediately and sustainably.

What the state institutions will do:

The theft of data has been stopped, but the institutions must continuously adapt, in order to reduce the risk of similar attacks in the future.

The most important changes concern limiting the data accessible without authentication, conducting security testing of all services and re-engineering the infrastructure to create a uniform and secure digital architecture.

Another issue that must be addressed is the fragmentation of responsibilities among governmental actors, which delayed the detection of the problem and, consequently, the coordination of the response to the incident.

Today, at the National Security Council, we discussed many solutions—short-term solutions to address the problem that has recently emerged, but especially medium- and long-term solutions, because it is clear that these risks will increase in the age of artificial intelligence.

We agreed to establish a working group under the leadership of the Prime Minister. For one month, this working group will propose systemic solutions to cybersecurity-related problems in Moldova, and in three months, we will meet again at the National Security Council to monitor the progress made during those three months.

We discussed addressing the architectural problems, because what I mentioned above shows that there was a serious problem with the system’s architecture; in other words, there was an error.

The system is old—and we must say that as well. We must also establish system expiration dates, because we are pleased when we launch a new system, but institutions sometimes forget to establish its operating lifespan and expiration date. A new system is needed, one that will resolve the architectural problem present in this system.

We discussed the need to reform the procurement system in the field of information technology. Here, we are talking about the need to further secure the process. We need partners that Moldova trusts, and for this we must also intervene in legislation and ensure that suppliers—the companies that create these systems—are held accountable, because they inherently have access to the systems and must therefore also bear responsibility for the data for which they develop them.

We discussed the need to create and implement clear rules for the entire life cycle of information systems, covering all stages—testing, operation and maintenance. This measure must ensure that information systems remain secure over time, and that they are replaced when they are no longer secure.

Sas for the governance, the problem was detected late in the first place, and when it was detected, the institutions’ response was not sufficiently coordinated. The government has committed to submit a proposal to clearly define the roles of the institutions, in order to avoid overlapping mandates while ensuring rapid and efficient interinstitutional cooperation.

And, as I earlier said, cybersecurity must be strengthened through regular testing, updates, continuous 24/7 monitoring, anomaly detection and the rapid identification and remediation of vulnerabilities, including through the use of artificial intelligence-based tools.

It is very clear that artificial intelligence creates risks, but it also creates opportunities and our institutions must likewise have access to these tools and be able to use them, in order to identify potential vulnerabilities before malicious actors do.

The technical details of more decisions cannot be made public for security reasons, so that they do not reach malicious actors.

An attack of this kind would not have been possible a year ago, but the speed at which information technologies—particularly artificial intelligence—are developing allows malicious actors to find and exploit vulnerabilities very quickly, leaving few traces that would enable the attack to be detected promptly.

The use of artificial intelligence reduces the cost of an attack and makes it more devastating.

Cyber incidents of this kind have occurred in more countries around the world with financial resources and advanced technologies, such as Denmark, Norway, France, Poland, Spain and South Korea. In Europe alone, more than 8,000 cyber incidents have occurred this year. As countries become increasingly digitalized, the impact of cyberattacks is becoming more and more dangerous for states, critical sectors of the economy, and, of course, the security of citizens.

Cyberattacks worldwide have targeted water purification systems, energy distribution systems, water-level regulation systems at hydroelectric plants, pharmaceutical production and medical facilities, as well as and food-storage systems. Cyberattacks have become increasingly frequent and are often part of the hybrid warfare arsenal used by Russia against Europe. Unfortunately, cyberattacks have become a new normal, a chronic threat.

Moldova must adapt, as it goes and learn how to prevent such incidents. When its defenses are bypassed or breached, it must detect and respond rapidly, restoring the functionality of services, if they have been affected.

Cyberattacks represent a national security problem and I recommend that politicians avoid turning this subject into a spectacle. Only institutions specializing in cybersecurity and national security should deal with this problem, not those who want to create a spectacle.

Dear citizens,

Information technologies are developing at a pace that is difficult to keep up with. They can be used for good purposes, but they can also be used by malicious individuals or states. I know that the uncertainty and concern surrounding this subject are great and understandable. The world around us is changing rapidly, but we are not powerless observers. The state must learn to protect itself and protect us as well as possible and as quickly as possible. We must invest in defense, including cyber defense, in digital education, and in being as cautious as possible. Risks cannot be eliminated, but we can learn and become better prepared to reduce them, and when they materialize, to face them in an organized and rapid manner. And, of course, we must not give up on digitalization and the use of digital services, especially in a small country, such as Moldova. Digitalization is the path toward greater efficiency and improved access to public services.

Thank you.