A cyberattack against the computer systems of the Republic of Moldova has compromised the personal data of about 450,000 people, close to 19% of the country’s population. The president, Maia Sandu, has confirmed this Friday the scope of the leak and has acknowledged that the institutions did not detect or communicate in time the seriousness of the incident, which has exposed significant deficiencies in the protection of public information.
The intrusion occurred between the 19th and the 23rd of October and allowed access to information stored in the records of at least ten state institutions. Among the compromised data are names, health information, pensions, social benefits, family relationships, and certain financial data.
The number of those affected involves a downward revision compared with the first official estimates, which pointed to 750,000 people. However, the Moldovan government recognizes that the magnitude of the incident remains considerable and has announced that the affected citizens will receive individual notifications.
Sandu has convened the National Security Council to examine what happened and coordinate the response of the institutions. The president has particularly warned about the risk that the stolen information will be used for phone scams, fraudulent messages, and identity theft.
A flaw made it possible to access the records of ten institutions
The preliminary investigation has identified problems in the design of the information-sharing systems of the Moldovan Administration.
As Sandu explained, the platforms checked which application requested the data, but did not adequately verify the identity of the person making the query or whether they had authorization to access that information.
This vulnerability allowed an application with deficient permissions to open the door to records from various public institutions.
The system also lacked sufficient controls to limit the amount of information consulted, as well as automatic alerts capable of detecting extraordinary extractions.
The attackers made around 11 million access requests and consulted approximately one million personal identification numbers, according to preliminary data from the Electronic Governance Agency (AGE).
October 20 was the day with the highest level of activity. Requests to digital services reached levels thirty times higher than usual, and data from more than 260,000 people was extracted.
Medical data, bank accounts and social benefits
The compromised information comes from different administrative records and contains especially sensitive data.
In addition to names, dates and places of birth, the attackers were able to consult information about citizens’ state of health, their general practitioners, situations of disability and social benefits.
Family members’ data, photographs, driving licenses, vehicles, business information, bank account numbers, tax debts and payment histories were also exposed.
The president has stated that no use of bank data has been detected to directly access citizens’ accounts. However, she has asked to take the utmost precautions in the face of possible fraud attempts.
The authorities recommend not providing personal information by phone, being distrustful of messages that request bank details, and contacting financial institutions or the police directly through their official channels.
The Government acknowledges delays and failures in coordination
The response to the attack forced the preventive disconnection of 82 digital public services and more than 30 computer systems and administration panels.
On October 21, the authorities managed to stop access to information about citizens’ family members. Two days later they began blocking the connections used by the attackers and, on October 24, the activity detected ceased.
Subsequently, new intrusion attempts occurred on October 25 and 27, which the authorities say they neutralized without any new extraction of information.
Sandu has admitted that the institutional response was insufficient, especially in communication with the population.
The president has acknowledged that the lack of a clear communication protocol caused delays and difficulties in distributing responsibilities among the institutions.
The Executive has created a working group led by the prime minister, Vasile Tofan, to coordinate the actions and review the vulnerabilities detected.
The affected public services have been progressively restored, after putting their systems through security checks.
The Prosecution Service investigates the theft of information
The Prosecutor's Office of Chisináu has opened a criminal investigation into possible offenses related to the violation of privacy and the disclosure of protected information.
The spokesperson of the General Prosecutor's Office, Violina Moraru, has confirmed the opening of proceedings, although she has not provided information about the possible perpetrators.
The Moldovan authorities have not officially attributed the attack to any country and have not publicly identified its authors.
Sandu has, for the time being, ruled out that there are indications of internal sabotage. The investigation must determine how access to the systems was obtained and who is behind the extraction of data.
The Government announces new security measures
After the meeting of the National Security Council, the authorities agreed to strengthen access controls to public records, limit the amount of information that can be consulted, and improve mechanisms for detecting suspicious activities.
The Electronic Governance Agency will notify those affected individually. In addition, banks will receive information about the citizens whose data was consulted so that they can carry out additional checks in the event of possible fraudulent operations.
The investigation will also have consequences for the management of digital services. The director of the Electronic Governance Agency, Nicoleta Colomeeț, has announced her resignation, and the authorities are preparing two audits to clarify security failings. The first results are expected for the end of November and the following for early December.
The possible involvement of a foreign actor
The Moldovan president has stated that the characteristics of the attack are consistent with the actions of a state actor, although she has insisted that the responsible parties have not yet been identified.
Moldavia, a country bordering Ukraine and Romania and a candidate to join the European Union, previously denounced interference and disinformation operations attributed to Russia. However, the authorities have not presented evidence that would allow linking this specific cyberattack to Moscow.
The incident has called into question the security of an Administration that has driven, over the past few years, the digitization of numerous public procedures. The Government’s priority now is to protect citizens’ information and prevent the data obtained during the attack from being used in new fraudulent operations.