Over 450,000 citizens of Moldova affected by cyberattack; Moldovan president says Electronic Governance Agency to notify concerned citizens by email, banks to be informed

More than 450,000 citizens of Moldova have been affected by the massive cyberattack on the national governmental system. The Electronic Governance Agency (AGE) will inform those affected by email, while banks will be notified about the individuals concerned, so they can carry out additional checks in the event of potential operations or transactions. President Maia Sandu today presented information to this effect following a meeting of the National Security Council (CNS).

According to the official, representatives of state institutions presented to the CNS the investigations conducted into the scale of the attack, the attackers’ way of operation, the vulnerabilities exploited, the measures taken immediately during those days, as well as proposals to strengthen the country’s cybersecurity and ensure a higher level of protection for digital governmental services.

“The incident occurred in infrastructure administered by AGE, affecting more services. The underlying cause was structural and related to governance: the systems verified only the application requesting the data, not the identity of the user or their right to access the information. Thus, a single application with incorrectly configured access opened the registers of at least ten institutions. The attacker, possessing a set of IDNPs, entered the system and extracted data that was subsequently used to gain further access and extract complete files. The incident is the consequence of an architecture in which data from all registers is accessible through a single point, without control by the holders of those registers and without volume limitations. There was also no control over the volume of data extracted, meaning there was no automatic alert when a certain extraction threshold was exceeded,” Maia Sandu said.

Automated requests originating from more than 638 IP addresses that concealed their true source began on the evening of October 19. The most intense day was October 20, when approximately one million requests were recorded in a single day—30 times more than the average. Also on October 20, more than 260,000 records concerning relatives were extracted.

“On October 21, AGE stopped the extraction of data concerning relatives. On October 23, the blocking of the attackers began. On October 24, all attacks had been blocked, and the attackers were no longer able to steal data. Attempts continued, but were repeatedly blocked by the institutions. Communication by state institutions about the incident was delayed and did not address all of the people’s concerns. In addition, the lack of a communication protocol for such a situation led to hesitation regarding the roles and responses of the institutions. The latest assessments show that the data of more than 450,000 citizens was accessed. This is a smaller number than the one circulated in recent days, but it is still a large figure. These people are to be notified by AGE,” Maia Sandu noted.

Following the attack, AGE disconnected all electronic services and platforms integrated with MPay, and after the problems were resolved, they were gradually restarted.

“The problem in the authentication and access control service have been resolved. It is being verified whether the source requesting the data is the holder of the right to access it. Access points have been secured through mandatory authentication, while responses have been limited to providing only the strictly necessary data. The administrators of all systems integrated with MPay received instructions and underwent an additional verification test implemented as an emergency measure,” the official said.

The president also said that the cyberattack had not compromised the integrity of banking data. Nevertheless, banks will be informed about the individuals whose data was accessed, so they can carry out additional checks in the event of potential transactions initiated in their names.

“Even though IBAN data was extracted, this information is not sufficient to access bank accounts. The risk lies in the fact that the extracted data may be used in combination. For example, an IDNP, information about relatives, or data from a driver’s license, sometimes together with an IBAN, may be used to contact various people for fraudulent purposes. In other words, someone who has access to certain data about you may call or write to you, pretending to be a representative of a bank or the police, in order to request additional information. Dear citizens, no state institution or bank will ask you by phone or SMS for PIN codes, passwords or card details. If you receive such a call, hang up and call the concerned bank or the police directly, using the phone numbers displayed on the institutions’ official websites, not the number from which you were contacted. It is better to reject a call than to fall victim to fraud. AGE has published phone numbers and other contact details that citizens can use, if they suspect an attempted fraud or need information about their personal data. For immediate assistance, call 112,” Maia Sandu said.

She noted that improving our cybersecurity depended both on the state’s ability to secure its infrastructure and on each individual’s ability to protect their data.

“We have agreed with the institutions, including the Education and Research Ministry, to prepare framework lessons for middle and high school students, during which young people will be taught more basic rules regarding the protection of personal data. They include avoiding the use of overly simple passwords or the same password for multiple platforms, as well as changing them regularly. The lessons will also address enabling two-factor authentication for email, social networks, and other applications, paying increased attention to suspicious links or free offers, as well as other technical solutions. We hope that, later on, young people will also be able to help their parents become more vigilant and better protected. At the same time, the Cybersecurity Agency will prepare a data protection guide with clearly explained steps for all citizens,” Maia Sandu emphasized.

The head of state added that the theft of data had been stopped, but institutions must continuously adapt, in order to reduce the risk of similar attacks in the future.

“One of the most serious consequences is, in fact, the weakening of trust in the country’s cybersecurity and in the safety of digital services. It is precisely in this area that the responsible state institutions must act immediately and sustainably. The most important changes concern limiting the data accessible without authentication, security testing of all services, and the reengineering of the infrastructure, in order to ensure a uniform and secure digital architecture. However, another problem that must be addressed is the fragmentation of responsibilities among governmental actors, which delayed the detection of the problem and, consequently, the coordination of the response to the incident. We have agreed to create a working group led by Prime Minister Vasile Tofan. Within one month, this group will propose systemic solutions to cybersecurity-related problems. In three months, we will meet again, in order to monitor the progress made during this period. At the same time, we must also establish expiration dates for information systems. We are happy when we launch a new system, but institutions sometimes forget to establish its service life and the date on which it must be replaced. We also discussed the need to reform the procurement system in the information technology sector. We must better secure this process and work with trusted partners. Another objective is to strengthen cybersecurity through periodic testing, updates, continuous 24-hour monitoring, anomaly detection, the identification and rapid remediation of vulnerabilities, including through the use of artificial intelligence-based tools,” Maia Sandu said.

Similar cyber incidents have occurred in more countries around the world, including states with significant financial resources and advanced technologies, such as Denmark, Norway, France, Poland, Spain and South Korea. In Europe alone, more than 8,000 cyber incidents have occurred this year.

“Cyberattacks have become increasingly frequent and are often part of the hybrid warfare arsenal used by Russia against Europe. Unfortunately, they have become a new normal, a chronic threat. Moldova must adapt as it goes and learn how to prevent such incidents, and when defense mechanisms are bypassed or compromised, detect the attacks and intervene quickly, restoring the functionality of the affected services. Cyberattacks represent a national security problem and I urge politicians to avoid turning this subject into a spectacle. Cybersecurity and national security must be handled by specialized institutions, not by those who want to create a spectacle. Information technologies are developing at a pace that is difficult to keep up with. They can be used for beneficial purposes, but they can also serve malicious individuals or states. We must invest in defense, including cyber defense, in digital education, and we must be as cautious as possible. Risks cannot be eliminated, but we can learn and prepare better to face them, and when they materialize, we must be able to respond in an organized and rapid manner. And, of course, we must not give up on digitalization and the use of digital services, especially in a small country, such as Moldova. Digitalization contributes to increased efficiency and improved access for citizens to public services,” the president concluded.

The National Security Council today assembled, after a cyberattack had targeted information systems between October 19 and 23, 2026. A criminal case has been opened in connection with the incident.