Prime Minister on cyberattack targeting public digital services: Authorities investigating possible involvement of foreign actors

The cyberattacks carried out between October 19 and 23 targeted approximately one million IDNPs, while preliminary data indicate that, in around 750,000 cases, at least one piece of information was extracted. Prime Minister Vasile Tofan said at the beginning of today’s Government meeting that the Republic of Moldova is the target of coordinated and large-scale attacks aimed at both citizens’ data and the state’s digital infrastructure. According to the official, the authorities are also investigating the possible involvement of foreign state actors.


“The cyber incident seems extremely important to me and is the main issue on today’s agenda. Our country is the target of coordinated and large-scale cyberattacks. We are not talking about an isolated incident,” Vasile Tofan said.


The Prime Minister said there were indications of broader campaigns, and that the relevant services were also investigating the involvement of foreign state actors in the recent incident.


“Not only citizens’ data but also the state’s digital infrastructure are being targeted. We must treat cybersecurity as a national security issue,” the head of Government stressed.


According to the Prime Minister, several attacks were recorded between October 19 and 23, targeting approximately one million IDNPs. Preliminary data show that, in around 750,000 cases, the attackers extracted information.


“This does not mean that 750,000 accounts were hacked. It means that, in 750,000 cases, at least one data element – the first name, last name, year of birth, or at least one such element – was extracted,” Vasile Tofan explained.


The head of the Executive said that the attackers exploited vulnerabilities in certain digital services and automated the extraction of information. Some of these vulnerabilities might have remained undetected under ordinary circumstances, but the use of artificial intelligence allegedly facilitated their identification and exploitation.


“We must acknowledge that some systems had these vulnerabilities, and our responsibility is to fix them and prevent the incident from happening again,” the Prime Minister said.


Tofan stated that bank card data had not been compromised because such data are not stored on Government servers, but on the servers of banks and payment system operators.

According to Vasile Tofan, the main risk for citizens in the coming period is the use of the extracted data in social engineering attempts. The people affected could receive SMS messages, emails, or phone calls in which criminals attempt to gain their trust by using personal information to obtain passwords or other confidential data.


“The main risk is that citizens will become targets of social engineering attacks, receiving SMS messages, emails, or calls in which potential fraudsters try to build trust, mention some of the data extracted during this latest attack, and persuade them to disclose a password received via SMS, an email password, or other information,” the Prime Minister warned.


He urged citizens to remain vigilant, especially in the coming days, and not to access unsolicited links or disclose passwords and verification codes following suspicious calls or messages.


“Once again, I urge all citizens to be as vigilant as possible, especially in the days ahead,” Vasile Tofan said.


The Prime Minister announced that, on October 23, the authorities stopped the unauthorized extraction of data and ordered an assessment of 82 important digital services. Of these, 30 were disconnected as a preventive measure.

According to Tofan, further attack attempts took place on October 25 and 27 and were detected and blocked. Most of the targeted services have been remediated, while the authorities are working to restore their functionality.


“We apologize if certain public services are unavailable. We strongly ask you to understand why we are taking this action,” the Prime Minister said.


He said that the MPAS service had been restored, while functionalities requiring additional checks were being handled separately.

The teams of the Electronic Governance Agency (AGE), the Information Technology and Cybersecurity Service (STISC), the Cybersecurity Agency (ASC), and the Intelligence and Security Service (SIS) are involved in managing the incident.

The Prime Minister also announced the involvement of specialists from the private sector. Orange Systems is providing technical expertise without financial compensation, according to his statement.


“We have involved technical expertise, including from the private sector. I want to be transparent: it is Orange Systems, which is doing this without any financial benefit. I believe it is important to involve the best cybersecurity specialists we have here in the Republic of Moldova, especially because we have limited resources,” Tofan said.


The Prime Minister said that, in addition to remedying the identified vulnerabilities, the authorities would undertake structural changes to strengthen the state’s digital security.


“In the short term, the priority is to fix the immediate vulnerabilities, but we must make structural changes,” Vasile Tofan said.


One of the priorities is to improve coordination among the institutions responsible for digital infrastructure. In this regard, the Government will work to strengthen governance and cooperation among the AGE, STISC, ASC, the Center for Information and Communications Technology in Defense (CTIV), and the Public Services Agency (ASP).

Tofan also announced the accelerated establishment of a national cybersecurity center, known as a SOC, which will operate within the ASC.


“We need a national cybersecurity center, a SOC, but it is not a new entity; it is a function that will operate within the ASC. The ASC has already been working on this for some time, and we are in the final months of completing this project. It is very important to have this national SOC,” the Prime Minister said.


Another measure concerns the rapid procurement of technological protection solutions. According to the head of the Executive, instructions were issued at the meeting of the National Crisis Management Center held the previous day to identify and procure tools such as Cloudflare and a Web Application Firewall.


“These are solutions that do not cost very much, but they could have largely prevented the current situation, the current incident,” Tofan said.


The Prime Minister also announced that the authorities need continuous audits and automated vulnerability scanning, including with the help of artificial intelligence.


“You can fight AI only by using AI on our side as well. We have turned to our foreign partners to help us gain access to models that are not available to the general public. We have also contacted our partners in Estonia to help us with expertise,” the Prime Minister said.


In the context of the incident, Vasile Tofan also announced changes in the leadership of the Electronic Governance Agency. AGE Director Nicoleta Colomeeț will step down, while Artiom Cociu will serve as interim director.

To illustrate the scale of cyber threats, Vasile Tofan referred to incidents reported in other countries, mentioning Denmark, France, and South Korea.

According to figures presented by the Prime Minister, approximately 8.8 million accounts were reportedly made public in Denmark on October 6. In France, an incident in April targeting the National Agency for Identity Documents allegedly affected approximately 11.7 million accounts. Tofan also mentioned the compromise of the accounts of around 33 million users of the South Korean platform Coupang.


“These attacks are coordinated and are occurring even in countries with much larger budgets and far greater resources than ours. This once again highlights how vulnerable we are, given our much more limited resources,” the head of Government said.


The Prime Minister also referred to a report by the European Union Agency for Cybersecurity (ENISA), which, according to the figures he cited, recorded 8,200 incidents during the latest reporting period, 2,600 of which targeted the public sector.


“Even if we cannot control all incidents, we have an obligation to be fully transparent about what happened, the existing vulnerabilities, and the way we respond as a state,” Vasile Tofan said.


In this context, the Prime Minister mentioned two projects on the agenda of today’s Government meeting: one concerning the fight against fraud involving non-cash payment instruments, and another regarding electronic identification and trust services, including electronic signatures. According to him, both initiatives had been prepared earlier and aim to strengthen the state’s digital capabilities.