Governo da Moldávia Registros de mais de 10… · Breach

[Single source] Moldova confirms October attack accessed data of 450,000 citizens

Nov 09, 2026 · 1 min read

Moldova's president said the October cyberattack accessed data of about 450,000 citizens. Systems checked the requesting app rather than users' rights, exposing registries at more than 10 institutions. Authorities continue to investigate the breach.

By HIFY Radar newsroom Updated 11/09/2026 05:14 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

Moldova's president says roughly 450,000 citizens had personal data accessed in October's cyberattack against state systems. The announcement came in press statements following a sitting of the National Security Council. According to a summary of the remarks, the affected systems checked the requesting application rather than users' access rights, opening registries at more than 10 institutions.

What happened

Observed

Official press statements were delivered following a meeting of Moldova's National Security Council and published through the state news agency Moldpres.

Alleged

As summarized on X by the account DailyDarkWeb, the president announced that approximately 450,000 citizens had data accessed in October's cyberattack, presenting fresh findings on the earlier breach: the compromised systems validated the requesting app instead of users' rights, which exposed registries at 10 or more institutions.

Why it matters

Inferred

If confirmed, a breach touching 450,000 citizen records would represent one of the most significant data exposures in the country, with potential consequences for identity fraud and for public trust in digital government services.

Inferred

The described failure mode: authorizing applications rather than users: points to a systemic access-control weakness rather than a single compromised database, since registries at more than 10 institutions were reachable through it.

What to do

Inferred

The available statements do not include specific protective measures for affected citizens. Until official guidance is published, residents should follow announcements from Moldova's authorities and treat unsolicited contact that references their personal records with caution.

Confirmed and still uncertain

Alleged

Known so far: an estimated 450,000 citizens had data accessed; the exposure stemmed from systems that checked the requesting app rather than users' rights; registries at more than 10 institutions were affected; and the findings relate to a cyberattack first reported in October.

Inferred

Not established in the available evidence: the names of the affected institutions, the categories of data exposed, whether data was copied or merely viewable, who was behind the attack, and any remediation timeline. The full text of the official statements was not captured in this batch, so the figures rest on a secondary summary.

What people are saying

Observed

DailyDarkWeb, an account tracking data-breach news on X, summarized the announcement: 'Moldova's president says ~450,000 citizens had data accessed in October's cyberattack. Systems checked the requesting app, not users' rights, opening registries at 10+ institutions.'

Observed

The president's remarks were delivered in press statements after the National Security Council meeting, carried by the official state news agency Moldpres.

Evolution

Alleged

The announcement marks a new stage in a story that began with October's cyberattack: authorities had previously disclosed the breach, and the National Security Council statements now quantify the impact: about 450,000 citizens: and explain how access control failed, which the summary describes as fresh findings on the earlier breach.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The core technical finding, as summarized: the affected systems performed authorization at the application level: checking which app was making a request: without verifying the requesting user's rights. An application that passed that check could open registries across more than 10 institutions.

Sources and evidence

Observed

This brief draws on two items: the primary source: official press statements published by Moldpres following the National Security Council sitting, whose body text was not included in the batch: and one discussion item, a post by DailyDarkWeb on X summarizing the president's remarks.

Inferred

Because the primary statement's full text was unavailable, all specific figures and the description of the access-control flaw are sourced to the secondary summary and remain unverified against the official record.