Moldova investigates possible foreign involvement in major government cyberattack

Moldova is investigating whether foreign state actors were involved in a major cyberattack on its government systems that exposed sensitive personal information and disrupted dozens of public services, the country’s prime minister said Wednesday.

Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens’ personal data and government digital infrastructure, according to local media reports.

“Our country is the target of coordinated and large-scale cyberattacks. We are not talking about an isolated incident,” Tofan said, adding that authorities were examining the possible involvement of foreign state actors.

Moldova has not publicly attributed the attack to any country or hacking group.

Tofan’s statement came a day after Moldova’s Electronic Governance Agency (AGE) disclosed that hackers had exploited vulnerabilities in government services to extract large volumes of personal information between October 19 and 23.

The attackers made approximately 11 million requests to access data through government services. Preliminary findings indicate that information linked to about 750,000 identification numbers was extracted, although not every affected individual had all categories of personal data exposed.

The compromised information may include names, dates and places of birth, family relationships, health insurance status, social benefits, pensions, disability records, driver’s licenses, photographs and vehicle ownership details.

Financial information, including bank account numbers, tax debts and government payment histories, may also have been accessed, according to the agency. Authorities said bank card information was not compromised and investigators had found no evidence that attackers had altered official government records.

According to the agency, the hackers exploited vulnerabilities in services that did not require authentication and used the information they obtained to extract additional data from interconnected government systems.

In response, authorities inspected 82 digital public services and temporarily disconnected those considered vulnerable, along with more than 30 government information systems and administrative panels.

The disruptions affected a range of public services, including online applications for construction permits, veterinary transport authorizations, medicine imports and food safety registrations, according to local media reports.

Most affected services have since been secured, and authorities are gradually restoring access following additional security checks, the agency said.

Authorities said they blocked unauthorized access on October 23 but detected additional attempts to breach government services on Sunday and Tuesday. Both attempts were unsuccessful.

The government warned that stolen information could be used in fraud schemes, including attempts to impersonate banks or public institutions to obtain passwords, authentication codes or money.

Government spokesperson Dumitru Ciorici said the incident could be part of a broader campaign of hybrid attacks against Moldova.

The country of approximately 2.4 million people, which borders Ukraine and Romania, has faced repeated cyberattacks and influence operations since Russia launched its full-scale invasion of Ukraine in 2022.

Moldovan authorities have previously accused Russia of conducting destabilization campaigns aimed at undermining state institutions and public confidence in the country’s pro-European government under President Maia Sandu.