STISC: Personal data of around 750,000 people may have been extracted following cyberattack on digital public services in Moldova

Approximately 750,000 state identification numbers (IDNPs) may have been targeted for unauthorized data extraction following the cyberattack on government systems of Moldova. According to preliminary investigations, during October 19-23, attackers queried approximately one million IDNPs in an attempt to get personal data, the Information Technology and Cyber Security Service (STISC) announced, cited by MOLDPRES.

According to the institution, the targeted information includes identification data, information about first-degree family members, insured status, family doctor, social benefits, pensions, disability, driving licenses, photographs, vehicles and companies owned or managed. Financial information, including IBAN codes, tax debts and payment history through MPay, may also have been extracted.

The authorities say that not all targeted individuals had all categories of data exposed. The main risk is the use of the information in fraud attempts and online manipulation.

The unauthorized data extraction was stopped on October 23 at 11:30 a.m. On the same day, the Electronic Governance Agency (AGE) ordered the preventive disconnection of 82 public services and more than 30 information systems and administration panels. The competent institutions were informed and received technical recommendations for remediating the vulnerabilities.

Subsequently, specialists identified and blocked a new attempt to force access to more government services on October 25, at around 2:00 a.m. Other data extraction attempts were recorded on October 27, at around 7:00 a.m., but were unsuccessful.

According to STISC, most of the affected services have already been remediated and will be restored after the security measures are reconfirmed. The authorities are conducting a comprehensive audit, in order to determine the exact scale of the incident and prevent further attacks.

Institutional representatives say that bank card information was not affected. Payments through MPay and EVO are processed through banks’ secure systems, while the government platform does not store this sensitive data. Moreover, simply knowing an IBAN does not allow access to a bank account or the execution of unauthorized transfers.

The investigations have not identified any unauthorized changes to data in state registers. The authorities emphasize that accessing information about real estate or a company does not amount to transferring ownership rights.

The attack allegedly exploited vulnerabilities in services accessible without authentication. According to STISC, one electronic service incorrectly recorded the legal basis for data processing; that is why, some citizens noticed operations associated with requests for civil status documents or the issuance of a driving license in the access history of the EVO application.

The investigation of the incident involves the Cybersecurity Agency, STISC, the Intelligence and Security Service, the Electronic Governance Agency and other competent institutions, including cybercrime-fighting units of the Police. The authorities are also cooperating with banks, telecommunications operators and other private-sector actors to strengthen protective measures.

Citizens are urged to exercise caution when receiving suspicious phone calls, text messages or emails, not to disclose passwords or authentication codes and not to access unsolicited links. People are also advised not to authorize payments at the request of unknown individuals and to verify any unusual request by contacting the institution or bank directly through official channels.

The authorities recommend directly verifying information in the case of alarmist messages referring to family members as well. If unknown transactions or operations are noticed, citizens should immediately contact the relevant service provider.

The scale of cyberattacks against public institutions is increasing internationally, while the automation of attacks with the help of artificial intelligence is enhancing the risks. Thus, according to the latest report by the European Union Agency for Cybersecurity (ENISA), dated September 22, 2026, more than 8,200 cyber incidents in the EU were analyzed during the reporting period, of which approximately 2,600 targeted public administration, the most attacked sector.

The authorities said they would inform the public about the results of the investigation, additional protection measures and the restoration of digital services.