VIDEO // Cyberattack on Moldova launched from abroad; MP says IP addresses from six countries identified

The cyberattack on the information systems of Moldova was carried out from abroad, and IP addresses from six countries were identified during the investigations. Two audits will establish the technical vulnerabilities of the systems and how the attack was organized. The head of the parliamentary commission for national security, defense and public order, Lilian Carp, made statements to this effect following hearings on this case held at the parliament today.

According to Carp, the accounts and IP addresses used in the attack are currently known, but they do not yet allow for the direct identification of the individuals or entities that organized it. The countries from which the IP addresses originated include EU member states and countries in Oceania.

The lawmaker said he could not state with certainty who was behind the attack, but he did not rule out the involvement of foreign state actors. He explained that, as a rule, non-state attackers claim responsibility for their actions or try to sell stolen data on the darknet—neither of which occurred in this case.

Two audits will be conducted to clarify the circumstances. The first will analyze the technical vulnerabilities of the systems, while the second will examine the structure and organization of the cyberattack, including in order to help identify those behind it. According to Lilian Carp, the results of the first audit are expected to be available by November 27, and the ones of the second - at the beginning of next December.





Fereastră în fereastră (iframe)

Another problem highlighted by the lawmaker concerns the lack of a response on behalf of the responsible institutions, given that the systems recorded an unusually high number of accesses. According to the lawmaker, between 20,000 and 40,000 accesses are usually recorded per day, whereas during the four days in which the attack took place, more than six million accesses were recorded.

“One question remains: how is it possible that the institutions did not notice such a large number of accesses? During the cyberattack, more than six million accesses were recorded over a period of four days,” Lilian Carp said.

The lawmaker said that law enforcement authorities must establish not only who organized the attack, but also whether there are individuals responsible for the institutions' failure to respond, given that the number of accesses far exceeded the usual level.

Carp also said that the number of people whose data had been accessed was less than half the total number of accesses. An individual may be targeted by multiple accesses across different platforms, and the exact figure will be determined following the audit.

The use of artificial intelligence by the attackers was also raised during the hearings. Lilian Carp emphasized, however, that this does not justify the institutions' failure to respond, as they also have tools to protect infrastructure and data.

The lawmaker drew attention to the need to use the government logging service MLog, which enables the recording of operations, the preservation of access histories and the subsequent verification of actions carried out in information systems. This information may help identify the individuals who accessed the data and detect potential abuses.

At the same time, Carp noted that, at this stage, there were no risks of other data being accessed and that there are reportedly no risks in the banking sector. According to him, the National Bank of Moldova has introduced additional filters to prevent access to banking data.

After the audits are completed, the results are expected to be examined in parliament or by the relevant commission. Lilian Carp called on governmental institutions to publicly communicate the circumstances of the attack and the measures taken to protect personal data.