Moldova confirms data of 750,000 national IDs extracted
Moldova's e-Government Agency (AGE) says about 1 million personal ID numbers (IDNP) were queried between Oct 19 and 23 in attempts to pull personal data. Preliminary estimates indicate data sets linked to about 750,000 IDNPs were extracted in the attack announced on Oct 24. Exposed categories include names and dates, and citizens should watch for scams using this data.
What happened
Personal data linked to about 750,000 Moldovan national ID numbers was extracted from public services between October 19 and 23, according to the Electronic Governance Agency (AGE). Prime Minister Vasile Tofan said the country faces coordinated, large-scale cyberattacks and that possible involvement of foreign state actors is under investigation. There is no official attribution to any country or group.
Why it matters
Potentially exposed data includes names, dates and places of birth, family relationships, social benefits, pensions, IBANs, tax debts and government payment histories; bank card data was not affected, according to AGE. The government warns the information could fuel scams impersonating banks or public institutions to obtain passwords, codes and money. The precautionary disconnection of 82 public services disrupted processes such as construction permits and medicine imports, now being gradually restored.
What to do
Warn employees and customers in Moldova about phishing and fraud attempts using real personal data. Instruct staff to verify any request for passwords, codes or payments through official channels. Monitor Moldovan government notices on service restoration.
For the technical team
- Affected
- Infraestrutura digital do governo da Moldávia e dados pessoais de cidadãos · Moldovan government digital public services. Data linked to about 750,000 IDNPs extracted; about 1 million IDNPs were queried. Exposed categories include names, date and place of birth, first-degree family members, health insurance, family doctor, social benefits, pensions, disability, driving licence, photo, vehicles and companies owned, IBAN, tax debts and MPay payment history.
- Exploitation
- Extraction confirmed by AGE and stopped on October 23 at 11:30. New access attempts on October 25 and 27 were blocked. No threat actor has been named; the prime minister said possible involvement of foreign state actors is under investigation.
- Fix
- No product patch. 82 public services and more than 30 systems and admin panels were inspected and precautionarily disconnected. Most have been secured and access is being gradually restored after additional security checks. No evidence of alterations to official government records.
- Vector
- Flaws in government services that did not require authentication, exploited to query data and then extract additional information from interconnected systems, according to AGE. Roughly 11 million requests were made between October 19 and 23.
- More details
- Audit by ASC, STISC, SIS and AGE is ongoing; the 750,000 figure is preliminary and not every person had every category exposed. Government spokesperson Dumitru Ciorici said the incident may be part of a broader hybrid attack campaign. Moldova, with about 2.4 million people, has previously accused Russia of destabilization campaigns, but has not attributed this attack.
Timeline
Government confirms data tied to about 750,000 ID numbers was extracted; about 1 million were queried between Oct 19 and 23.
Incident opened.
Sources 2 sources
- Moldova investigates possible foreign involvement in major government cyberattack The Record
- @DailyDarkWeb @DailyDarkWeb
