Russian apps, risk to digital security for Moldovans: data might reach Russia's Federal Security Service

Users from Moldova of Russian applications and platforms, such as Yandex, Odnoklassniki, or the vocal assistant, Alisa, are exposed to major risks concerning the security and confidentiality of personal data, warns the National Center for Personal Data Protection (CNPDCP), according to Radio Moldova.

The institution said that these platforms collected sensitive information – from bank data and location to contacts and travel history – stored on servers located in the Russian Federation. As a result, there is a risk that this data might be accessed by the Federal Security Service of Russia (FSB).

CNPDCP advises citizens to exercise caution, to carefully read privacy policies before installing the applications, and to avoid transmitting personal data that could be exploited against them.

Russian apps, a threat to the digital security of Moldovan citizens

The use of foreign online applications and platforms, especially those developed in the Russian Federation, which do not provide a proper level of protection for personal data, poses major risks to the digital security of Moldova’s citizens, said the National Center for Personal Data Protection (CNPDCP) in an answer to Radio Moldova.

Among the main risks associated with using apps managed by non-resident operators, whose servers are located outside the country, there is the personal data security, as these platforms frequently become targets for cyberattacks, such as phishing or hacking.

Data confidentiality, as providers can use the collected information - bank data, location, contacts, voice recordings, order history - for purposes other than those declared.

Cross-border data transfer reduces the control both of users and of national authorities over how it is stored and used.

An example is the Yandex Go app, which collects data on mobile devices, names, phone numbers, emails, travel addresses and banking details. CNPDCP recommends carefully reading the privacy policy before installation, noting that the data can be stored in Russia or in the European Economic Area. The institution emphasizes that Moldovan authorities face major difficulties in exercising control over platforms owned by non-resident companies, which limits citizens' ability to protect their digital rights.

To mitigate these risks, legislative changes have been made, including in the Road Transport Code, stipulating that electronic management systems can be used in Moldova only by legal entities registered in the country, with the obligation to notify the competent authorities.

Government: Criminal groups collect citizens' personal data and transmit it to Russia

Digital service users and online app users of Moldova must be careful about how they share their personal data, especially during election periods, warns government’s spokesperson Daniel Voda. He referred to taxi services and other online apps, emphasizing that they need to legally register in Moldova and guarantee that citizens' data does not leave the European area.

"Ultimately, the use or non-use of a service is at the discretion of the citizen, but the message from Moldova’s government is that, when we share our information – name, surname, phone, banking information, or identity and travel data, we must be careful about the apps we use and report any case of abuse," emphasized the government’s spokesperson in a comment for Radio Moldova.

The spokesperson highlighted the risks posed by criminal groups led by Ilan Shor, who is in Moscow, that have abusively collected personal data in more localities in the country, such as Orhei or the municipality of Chisinau. This data was transmitted to the Russian Federation, including to a private bank, and citizens have faced unwanted calls, fines, or even loans taken in their name without consent.

"In other words, the identity card, passport and other official documents confirming a person's identity are extremely personal data and cannot be offered to anyone. Personal data represents our identity and must be provided to others only under the conditions stipulated by law," Daniel Voda warned.

Recent legislative changes require every company to request the explicit consent of the citizen for processing personal data. Thus, telephone operators, transport service providers or other public services must ask the user before processing their information, added Daniel Voda.

Greater risks for those who are or intend to go to Russia

The level of data protection in Russia is strictly linked to the national interests of the state, which could endanger the personal information of Moldovan citizens, warns security expert Andrei Curararu from the Watchdog community.

He emphasizes that there have been documented cases where access to various devices, including smart home equipment, allowed Russian authorities to convict individuals in Russian courts, including for discrediting the Russian army. Also, there have been requests for access to Telegram encryption keys, and the Vkontakte service infrastructure was penetrated by the FSB.

The expert recommends caution in using any software originating from Russia.

"This creates a string of risks, especially for citizens on the territory of the Russian Federation, and not only. If information about them were to be sought in the FSB databases, they could be tracked, fined, and sanctioned, especially in the context of distributed information related to such articles as the so-called discreditation of the Russian army. In such a situation, any chat with more than two people could be used against citizens," warned the expert.

Curararu also said that blocking apps or limiting their access via Google Play and App Store would be a solution, but this does not solve the issue of the existing infrastructure in users' homes. Clear communication and explaining the dangers of these apps are necessary, the expert noted.

The warning from the National Center for Personal Data Protection comes in relation to repeated scandals in the Russian Federation regarding pressure on the company Yandex to give access to users’ data to secret services.

The Russian press writes that, in May 2025, a court in Moscow fined Yandex 10,000 rubles for not providing the FSB with access to data from the "smart home" of the station "Alisa".

Experts quoted by Vedomosti have noted that Russian legislation, known as the "Yarovaya law," has come to be interpreted more broadly, extending the obligation to provide data access practically about any IT infrastructure.

Therefore, Russian secret services could use all the functions of the smart home, including listening to orders given to the voice assistant, Alisa, and accessing other devices of users.