EXCLUSIVE "We can't change our IDNP." A lawyer's warning after the cyberattack that exposed the data of 750.000 people: What citizens must urgently do

Changing passwords for accessing electronic accounts, avoiding suspicious links and carefully checking phone calls are among the main measures recommended to citizens after the large-scale cyberattack on government systems in the Republic of Moldova. Lawyer and president of the Association for the Protection of Private Life, Sergiu Bozianu, warns that the risks are not limited to compromising some accounts, since identity information, such as the IDNP, name or data about family members, cannot be changed as easily as a password. The recommendations come after authorities confirmed that, between October 19 and 23, attackers tried to access data associated with a million IDNPs, and information related to approximately 750.000 of them was extracted without authorization.

According to the Electronic Government Agency, the information targeted includes identification data, information about family members, pensions, social benefits, driving licenses and certain financial data, including IBANs and MPay payment history. In this context, Sergiu Bozianu recommends that citizens secure their electronic accounts and change their passwords where possible.

"Among the first recommendations would be to change the access passwords for any public service account, where possible. I mean the same email address, change the access password, change the password for the electronic signature or other government services you have. But for the most part, the remedial measures should refer, in large part, to public authorities. Identity data has been defrauded, those unique data that establish our identity such as IDNP, name, surname, bank details, IBAN, data about family members. In this sense, citizens cannot change their IDNP, surname or surname. It is a major flaw, this data has been defrauded and there could be quite serious future consequences for each of us", the lawyer told Cotidianul.md.

Bozianu also draws attention to the risk that the information obtained by attackers will be used in fraud attempts over the phone or through messages.

"But we must be cautious, not to access links, not to interact with people on the phone, if we are presented with some atypical situations, in which we must provide a solution, some access codes. We must act with maximum intelligence, notify the police, 112 or the responsible authorities if we find certain situations or facts that could lead to the use of this data", concluded Sergiu Bozianu in his message.

We remind you that the cyber attack targeted several digital public services of the Republic of Moldova, with approximately 11 million requests for data access being registered. According to the authorities, the unauthorized extraction of information was stopped on October 23, at 11:30. To limit the consequences of the incident, 82 digital services were checked, and over 30 information systems and administration panels were disconnected as a precaution.

Subsequently, on October 25 and 27, specialists identified new unauthorized access attempts, which were blocked. Authorities state that the investigation is ongoing, and the affected services are being gradually restored, after verifying their security.

Prime Minister Vasile Tofan said on Wednesday, October 28, that the competent institutions are also investigating the possible involvement of foreign state actors. The Head of the Executive stressed that the incident must be treated as a national security issue. At the same time, he specified that the extraction of data associated with the approximately 750.000 IDNPs does not mean that as many accounts were hacked, but that, in each of these cases, at least one element of personal information was obtained without authorization.