Large-scale cyberattack in the Republic of Moldova. Personal data associated with about 750.000 IDNPs targeted by hackers. Information about families, pensions, accounts and properties, among those exposed

A cyberattack on the government digital infrastructure in the Republic of Moldova has allegedly allowed unauthorized access to personal information associated with approximately 750.000 state identification numbers (IDNPs). The data targeted includes information about family members, income from social benefits, pensions, properties, cars, tax debts and bank accounts. The Information Technology and Cyber ​​Security Service (STISC) announces that, between October 19 and 23, the attackers conducted interrogations on approximately one million IDNPs, and subsequently repeatedly tried to penetrate government services. Authorities warn that the main danger is the use of the information obtained for fraud and manipulation, but they assure that bank card data has not been compromised.

According to preliminary results of the investigation, the attackers attempted to obtain information from several state registries and information systems. The targeted data includes individuals' identities, information about first-degree relatives, health insurance status, family doctor, pensions, social benefits, and disabilities.

Information about driving licenses, photographs of individuals, means of transportation, companies owned or managed, as well as financial data, including IBAN codes, tax obligations, and the history of payments made through MPay, would also have been extracted.
STISC states, however, that not all individuals were exposed to all categories of information. The exact extent of the data accessed is to be determined during the investigation.

Dozens of public services disconnected after discovery of attack

The unauthorized extraction of information was stopped on October 23, at 11:30 a.m. On the same day, the Electronic Government Agency (AGE) decided to preventively suspend 82 public services, as well as over 30 information systems and administration panels.
The institutions managing the affected platforms have been notified and received technical recommendations to eliminate the identified vulnerabilities.

The attacks did not end with the blocking of the first security breach, however. On the night of October 25, around 02:00, specialists detected and blocked a new attempt to force access to several government services.

Other attempts to extract information were recorded on October 27, around 07:00, but, according to the authorities, they failed. In the meantime, most of the affected services have been remedied. Their re-operation will take place after verification and reconfirmation of security measures.

Bank card data was not compromised

In the context of concerns regarding the security of financial information, STISC representatives emphasize that the attack did not affect bank card data.

Payments made through MPay and the EVO app are processed through the secure infrastructure of banking institutions, and government platforms do not store sensitive card information.

At the same time, the authorities explain that simply knowing an IBAN code does not allow a person to withdraw money from the respective account or make transfers without authorization. The integrity of the information in the state registers would not have been compromised either. The investigations carried out to date have not identified any unauthorized changes to the data. In the same context, the responsible institutions specify that accessing information about a property or a company does not mean that the attackers can transfer ownership rights to these assets.

How did the attackers manage to access the information?

According to STISC, the attack allegedly exploited existing vulnerabilities in some electronic services that could be accessed without authentication.
The specialists also found that one of the government services was incorrectly recording the legal basis for data processing.
This deficiency explains why some citizens noticed in their access history in the EVO application operations associated with requesting civil status documents or obtaining driving licenses, even though they had not initiated such procedures.

To establish all the circumstances of the incident, authorities are conducting an extensive audit of the affected systems.

The Cyber ​​Security Agency, STISC, the Intelligence and Security Service, the Electronic Governance Agency, as well as specialized Police structures in combating cybercrime, are participating in the investigation.

State institutions are also collaborating with banks, telecommunications operators, and other private sector partners to strengthen the protection of digital infrastructure.

Authorities warn about fraud. What citizens need to know

Although bank card information was not affected, personal data accessed by the attackers could be used for fraud attempts. Citizens are urged to treat suspicious phone calls, SMS messages and emails with caution, especially when the callers claim to represent public institutions or banks. Authorities recommend not to communicate passwords, authentication codes or other confidential information and not to access links received from unknown sources. People are also advised not to confirm payments requested by unknown persons and to verify any unusual request by contacting the institution or bank directly, using official channels.

Increased attention should also be paid to alarmist messages that claim to be about family problems. In such situations, the information should be verified directly before making any payments or disclosing any personal information.

In case of identifying unknown banking transactions or operations, citizens should immediately contact the institution providing the respective service.

Public administrations, among the main targets of cyber attacks

The incident in the Republic of Moldova takes place in an international context marked by the intensification of attacks on the digital infrastructure of public institutions.

According to the report of the European Union Agency for Cybersecurity (ENISA), published on September 22, 2026, over 8.200 cyber incidents were recorded at the European Union level during the analyzed period.

Of these, approximately 2.600 targeted public administration, the most frequently attacked sector. Specialists also draw attention to the additional risks generated by the automation of cyber attacks through the use of artificial intelligence. In the Republic of Moldova, investigations continue to establish the exact number of people affected, identify exploited vulnerabilities and prevent similar incidents.

The authorities announce that they will return with information about the results of the investigation, additional security measures, and the timetable for the restoration of suspended digital services.