A cyberattack in Moldova between October 19 and 23, 2026, resulted in the unauthorised extraction of personal data belonging to more than 750,000 people from government digital infrastructure. The compromised information includes names, dates of birth, family details, health insurance records, pensions, bank account identifiers and payment histories. Moldova’s Electronic Governance Agency (AGE) warns that the stolen data could be used for fraud and online manipulation, according to TV8.
According to AGE, attackers targeted approximately one million personal identification numbers (IDNPs) in an attempt to extract information from government databases.
Following the discovery of the incident, authorities examined 82 digital services and temporarily suspended systems considered vulnerable.
The agency said its rapid response helped isolate the attack and prevent further data exposure.
Most affected services have since been repaired and will be restored once additional security checks are completed.
Cyberattack in Moldova: What Personal Information Was Exposed?
According to AGE’s preliminary assessment, the attackers obtained access to several categories of personal information.
Identity and Family Information
The exposed data may include:
- First and last names;
- Dates and places of birth;
- Information about immediate family members;
- Profile photographs;
- Driving licence information.
Health Insurance and Social Benefits
The compromised information also includes records concerning:
- Health insurance status;
- Registered family doctors;
- Pensions;
- Social benefits and allowances.
These details could potentially be exploited by criminals impersonating public institutions or social service providers.
Financial and Property Information
Other categories of exposed data include:
- International Bank Account Numbers (IBANs);
- Outstanding tax liabilities;
- Payment histories through the MPay platform;
- Information about vehicles owned;
- Details of companies registered to individuals.
However, AGE emphasised that not every affected person had all these categories of information exposed.
The amount and type of compromised data vary between individuals.
More Than 750,000 People Affected: Timeline of the Attack
According to the official chronology, the cyberattack began on October 19 and continued for several days.
October 23, 11:30 a.m. — Authorities successfully stopped the unauthorised extraction of personal data.
Immediately afterwards, 82 public digital services and more than 30 information systems and administrative interfaces were disconnected as a precaution.
The responsible institutions were notified and received technical recommendations to address the identified vulnerabilities.
October 25, approximately 2:00 a.m. — Cybersecurity specialists detected and blocked another attempt to force access to government digital services.
October 27, approximately 7:00 a.m. — Further attempts to extract information were recorded, but they were unsuccessful.
Authorities said monitoring of government digital infrastructure remains ongoing.
Were Bank Cards and Accounts Compromised?
Moldova’s Electronic Governance Agency says bank card information was not exposed during the cyberattack.
According to the agency, payments made through MPay and the EVO application are processed using banks’ secure systems.
The government platforms do not store sensitive bank card details.
Although some IBANs were among the exposed information, authorities stressed that knowing an IBAN alone does not allow someone to access a bank account or initiate unauthorised transfers.
However, criminals could combine an IBAN with other stolen personal information to make fraudulent communications appear more convincing.
For example, someone impersonating a bank employee could refer to genuine personal details before requesting a password, authentication code or payment confirmation.
Therefore, the available findings do not indicate that attackers gained direct access to citizens’ bank accounts, but the risk of financial fraud remains.
Could Hackers Transfer Property or Company Ownership?
Authorities also sought to reassure citizens about the security of their property.
According to AGE, investigations found no unauthorised changes to official state registers.
Accessing information about a property, vehicle or company does not amount to transferring legal ownership.
The findings therefore do not indicate that attackers were able to take ownership of citizens’ homes, vehicles or businesses.
Nevertheless, the exposed information could potentially be used in future impersonation or fraud attempts targeting property owners and business operators.
What Are the Main Risks for Affected Citizens?
The primary concern identified by authorities is social engineering — a form of fraud in which criminals exploit personal information to gain a victim’s trust.
Attackers may impersonate representatives of banks, government agencies or other institutions.
Knowing a person’s name, family details, pension information or registered family doctor could make such communications appear more credible.
Possible fraud attempts include:
- Requests for passwords and authentication codes;
- Instructions to transfer money to supposedly secure accounts;
- Requests to approve fraudulent banking transactions;
- Links to fake government or banking websites;
- False emergencies involving relatives, designed to pressure victims into sending money.
These are potential risks rather than evidence that every affected individual has already experienced financial fraud.
How to Protect Yourself After the Cyberattack in Moldova
AGE has urged the public to remain especially cautious when receiving unexpected phone calls, text messages or emails.
1. Never Share Passwords or Authentication Codes
Do not disclose passwords, one-time verification codes or banking login details over the phone, by SMS or through email.
Even if a caller knows genuine personal information about you, that does not prove they represent a legitimate institution.
2. Avoid Suspicious Links
Do not open unsolicited links, particularly those demanding urgent identity verification, payment confirmation or updates to banking details.
Access banking and government services through their official applications or websites.
3. Verify Requests Directly With the Institution
If someone calls claiming to represent your bank and reports suspicious activity, end the conversation.
Contact the bank yourself using its official telephone number or application.
Do not authorise payments or transfers at the request of an unknown caller.
4. Check Alarming Messages About Relatives
Criminals may exploit stolen family information to fabricate emergencies.
For example, they may claim that a relative has been hospitalised or urgently needs financial assistance.
Before sending money, contact the family member directly using a telephone number you already know.
5. Monitor Your Bank Accounts
Regularly review transaction histories and banking notifications.
If you notice suspicious activity, contact your bank immediately.
Where appropriate, change your password and review your account security settings.
How Did the Attackers Access Government Data?
According to AGE’s preliminary technical findings, the attackers exploited vulnerabilities in electronic services that could be accessed without authentication.
They subsequently used the information obtained to extract additional personal data.
The initial attack targeted an electronic service that incorrectly logged the legal basis for processing personal information.
As a result, some citizens noticed unusual entries in the data access history displayed in the EVO application.
These entries referred to services such as requesting civil status documents or obtaining driving licences.
The records reflected the way the affected service logged data processing activity and drew attention to unusual access to personal information.
Who Is Investigating the Cyberattack?
The investigation remains ongoing.
The incident has been referred to the Cybercrime Centre within Moldova’s General Police Inspectorate and the National Centre for Personal Data Protection.
Government authorities are also working with commercial banks and telecommunications operators to issue additional warnings and strengthen protections for citizens.
As of October 27, no definitive public conclusions had been announced regarding the identity of the attackers or all the circumstances surrounding the incident.
What We Know About the Consequences
The cyberattack in Moldova resulted in the unauthorised extraction of personal information belonging to more than 750,000 people.
However, authorities say bank card details were not compromised and no unauthorised modifications were identified in state registers.
The main danger now lies in the potential misuse of stolen information for telephone scams, phishing and other forms of online fraud.
Citizens are advised to treat unexpected requests for personal or financial information with caution, never share authentication codes and verify suspicious communications through official channels.
