Cyberattack on government systems. How citizens can check if their data has been accessed and where to file complaints

Citizens of the Republic of Moldova who suspect that their personal information has been illegally accessed following the cyberattack on government digital services can request verification and explanations from the Electronic Government Agency (AGE). If they suspect that their rights have been violated, they can subsequently file a complaint with the National Center for Personal Data Protection (CNPDCP). The institution has already initiated an investigation into the incident, in the context of which approximately 750.000 state identification numbers (IDNP) were allegedly targeted by unauthorized extraction of information. Authorities are trying to establish the circumstances of the attack and whether the responsible entities complied with legal obligations regarding data protection.

According to the CNPDCP, people who have noticed suspicious activities or want to find out if their information has been compromised should first contact the Electronic Governance Agency, responsible for administering government electronic services.
Requests can be sent to the address [email protected], with an electronic signature, or submitted in physical format, with a handwritten signature.
Citizens can request explanations about any access to their data, the institutions that carried out these operations, the purposes pursued and the legal grounds invoked. They can also request information about the consequences that the incident may have had on their personal data.

The National Center for Personal Data Protection recommends keeping all documents that could prove the existence of suspicious accesses. These include notifications received, screenshots showing the date and time of accesses, as well as responses provided by the institutions contacted.

These materials may constitute evidence in the event of a complaint being filed.

How to contact the Data Protection Center

If the explanations provided by the AGE are not satisfactory or there are suspicions of a violation of rights, the data subjects may notify the CNPDCP.

Complaints can be submitted using the form available on the institution's official website or in physical format. The use of the form is not mandatory, but the complaint must meet the requirements set out in Article 79 of Law No. 195/2024 on the protection of personal data.

If documents are submitted electronically, they must be signed with an electronic signature and accompanied by the relevant evidence.

The Authority explains that the initial address to the data controller is important, as it holds the information regarding the processing of personal data and the security measures applied. The response received may contribute to clarifying the situation and can be subsequently attached to the complaint.

At the same time, the CNPDCP specifies that it does not directly manage the databases of public institutions nor the IT systems in which citizens' information is stored. The obligation to ensure their protection, through appropriate technical and organizational measures, lies with the data controllers.

The Center announces that complaints related to the cyberattack will be examined after verifying the circumstances of the incident and completing the investigation. Reasoned decisions will be issued for each case, and the conclusions of the verifications and the measures ordered will be made public.
Citizens also have the possibility to address the courts directly, based on Article 74 of Law No. 195/2024. The action can be filed against the data controller or the person authorized by him, independently of the procedure for examining complaints by the CNPDCP.

One million IDNPs questioned during the attack

According to preliminary information, between October 19 and 23, the attackers allegedly queried approximately one million state identification numbers, trying to obtain personal information from the government systems of the Republic of Moldova.

Of these, approximately 750.000 IDNPs were allegedly targeted by unauthorized data extractions. The exact extent of the incident and the consequences for the individuals affected are to be determined during the investigations.

Meanwhile, the Chisinau Municipal Prosecutor's Office has initiated criminal proceedings in connection with the attack, based on reasonable suspicion of the commission of crimes.