Moldova Investigates Possible Foreign Involvement in Major Government Cyberattack

Cyberattack on Moldovan Government Systems

Moldova's Prime Minister Vasile Tofan announced an investigation into potential foreign state actor involvement in a significant cyberattack targeting government systems. The incident, which occurred between October 19 and 23, resulted in the exposure of sensitive personal information and caused disruptions to numerous public services across the country.

Scope of the Breach

The Electronic Governance Agency (AGE) reported that attackers made approximately 11 million requests to access data. Preliminary findings indicate that information linked to about 750,000 identification numbers was extracted. While not all categories of personal data were exposed for every individual, the compromised information may include names, dates of birth, family relationships, health insurance status, social benefits, pensions, disability records, driver's licenses, photographs, and vehicle ownership details. Financial information such as tax debts and government payment histories may also have been accessed, though bank card information was not compromised, and no alterations to official government records were found.

Attack Vector and Response

Hackers exploited vulnerabilities in government services that did not require authentication, using the initial access to extract additional data from interconnected systems. In response, Moldovan authorities inspected 82 digital public services and temporarily disconnected vulnerable ones, along with over 30 government information systems and administrative panels. This led to disruptions in services like online applications for construction permits, veterinary transport authorizations, medicine imports, and food safety registrations.

Broader Campaign Suspected

Prime Minister Tofan stated that this incident might be part of a larger, coordinated campaign targeting both citizen data and government digital infrastructure, indicating that it is not an isolated event. Moldova has not yet publicly attributed the attack to any specific country or hacking group.