Andrei Curăraru: Cyberattack can undermine administrative reform and trust in digital services. Stolen data can be used for scams and hybrid warfare

The personal data of hundreds of thousands of citizens of the Republic of Moldova, extracted following cyber attacks on state information systems, could be used for much more convincing telephone scams. Public policy and security expert Andrei Curăraru warns that people who know a citizen's name, IDNP, family or pension information are not necessarily representatives of a bank or a public institution. In his opinion, the authorities must explain what information was compromised, strengthen the security of the systems and investigate institutional responsibilities.

"In 2026, no database is completely secure. It matters who attacks you, how insistent they are, and what resources they have," warned Andrei Curăraru, referring to the cyberattack on digital public services in the Republic of Moldova.

According to preliminary information provided by the authorities, approximately one million IDNPs were targeted between October 19 and 23, and in about 750.000 cases, information was extracted. The data targeted includes identification information, family information, pensions, social benefits and some financial information. The authorities stated that not all affected individuals had all categories of data exposed and that bank card information was not compromised.

Curăraru believes that Russia is a plausible hypothesis in the investigation of the attack and recalls previous warnings by the Intelligence and Security Service regarding the interest of Russian special services in the data of Moldovan citizens. However, identifying those who organized the attack and proving their involvement may be difficult, as the attackers can hide their traces through foreign servers and compromised computers.

Prime Minister Vasile Tofan said authorities are also investigating the possible involvement of foreign state actors. For now, the identity of those behind the attack has not been officially established.

The most immediate danger to citizens is represented by telephone scams, the expert warns. Illegally obtained personal information can be used to build credible scenarios, in which scammers claim to represent a bank and try to gain access to victims' accounts.

"Someone calls you and says they're from the bank. They tell you your name, when you were born, what IDNP you have. They may also know who your husband or wife is, what pension you receive, what payments you've made, then they scare you that someone is trying to steal your money and ask for the code sent via SMS. Until yesterday, it was precisely such details that convinced some that they were talking to the bank. Now, this data can also reach scammers, and that's enough to make a fake call much more credible," explains Andrei Curăraru.

The expert warns that personal information is not enough to confirm the identity of the interlocutor. Therefore, he calls on banks and microcredit companies to review their customer identification procedures, including in the case of phone calls and online loan applications.

"IDNP, personal data, including pension or debt information, does not prove that the person you are talking to is who they claim to be," the expert warns.

His recommendation for citizens is to hang up suspicious calls, contact the institution at an official number, and not disclose the codes received via SMS to anyone.

Curăraru argues that the incident should be viewed not only as a technical issue, but also in terms of the effects on citizens' trust in the state. According to the expert, the digitalization of public services can simplify people's interaction with authorities, but such an attack may cause citizens to continue to prefer traditional procedures, even if they involve travel and time lost at counters.

In his opinion, the cyberattack may also affect the reform of local public administration. The administrative reorganization plans foresee changes in the structure of districts and strengthening the capacity of city halls to provide services. Some of these services are expected to be accessible digitally, but the distrust caused by the compromise of personal data could make it difficult to implement the reform.

Curăraru warns that in rural areas, some citizens may prefer to go to the city hall and talk directly with a known official, rather than using electronic services. In his opinion, attacks on digital infrastructure can fuel distrust in reform, including in the context of local elections in 2027.

"An attack on digital services can also hit the state's ability to make reforms. This must be understood now, while the laws are still being discussed," the expert warned.

It calls on the Government to communicate the scale of the incident and its consequences in a way that citizens can understand. Authorities must explain who was affected, what categories of data were exposed, and what measures people can take to protect themselves.

At the same time, Curăraru considers it necessary to strengthen the capacity of institutions to identify vulnerabilities before they are exploited and to react quickly in case of security incidents. The expert welcomes the request for support from Estonia, mentioned by the prime minister, but states that responsibility for any deficiencies must be established through an investigation.

"If someone slept on the job, let them answer. But let's not delude ourselves that we solved everything with ritual resignations at the Electronic Governance Agency," he declared.

In the expert's opinion, the investigation must examine the entire institutional chain involved in system security and data protection, including the responsibilities of the Electronic Government Agency, cybersecurity structures, and the State Fiscal Service.

Curăraru believes that the attack must also be analyzed in the context of hybrid warfare. He estimates that a state actor, most likely Russia, could be behind the operation, but this hypothesis does not represent an officially confirmed conclusion.

The expert points out that cybersecurity incidents have also affected other countries, including Denmark and France. Such cases show that even countries with greater resources for digital security are not immune to such risks.

According to the expert, the authorities' response must combine transparent communication with citizens, strengthening the protection of information systems, and establishing responsibilities for any deficiencies that allowed the incident to occur.