On 30 October 2026, Moldova’s Electronic Governance Agency (AGE) said the cyber threat against government systems persists, even as 61 digital public services are back online and 21 remain unavailable. The statement follows its 27 October preliminary estimate that data sets linked to about 750,000 personal identification numbers (IDNPs) were extracted without authorisation. Attackers had queried roughly one million IDNPs between 19 and 23 October.
Timeline
AGE’s first notice, on 24 October, said the incident occurred on the night of 22 October, when staff spotted unusual activity in how public services were accessed and queried. Later findings widened the window of extraction attempts to 19–23 October. Extraction was stopped on 23 October at 11:30, and 82 public services plus more than 30 information systems and administration panels were disconnected. Around 02:00 on 25 October, specialists blocked another forced-access attempt, and new extraction attempts around 07:00 on 27 October failed.
On 28 October, Prime Minister Vasile Tofan announced that AGE director Nicoleta Colomeeț was leaving, with Artiom Cociu as interim head, according to Radio Free Europe’s Moldovan service. Tofan said there are indications of a wider campaign involving foreign state actors, without naming anyone. President Maia Sandu called a National Security Council meeting, and the Central Electoral Commission said voter data was unaffected.
Data Exposed
AGE’s preliminary estimate lists names, dates and places of birth, first-degree family members, insurance status, family doctor, social benefits, pensions, disability status, driving licences, photographs, vehicles, and companies owned or managed. Financial items include IBANs (international bank account numbers), tax debts and MPay payment history. AGE stresses that not everyone had every category exposed. Bank card data was not affected, because card payments run through banks’ systems, and AGE says knowing an IBAN does not give access to an account. No unauthorised changes to state registers have been found.
How It Worked
AGE’s first notice recorded about 11 million access requests aimed at obtaining personal data without authorisation. Its later technical explanation says attackers exploited vulnerabilities in services reachable without authentication, then used the data they obtained to run further extractions. The initial hits landed on an e-service that logged its legal basis for processing data incorrectly, which is why citizens saw entries for civil-status document requests and driving-licence issuance in their EVO access history. Risky Business, a security newsletter, describes a logging service exposed online without authentication; AGE has not used those words.
Our Analysis
Eleven million requests against about one million queried IDNPs works out to roughly eleven requests per ID, which points to automated querying rather than manual browsing. That is our arithmetic, not an AGE finding. The case shows a trade-off in integrated government platforms: linking registers makes services convenient, but one unauthenticated endpoint can open a path to data held elsewhere. Authentication on every service, rate limits and accurate audit logs are the usual defences. The production cost is visible too: AGE disconnected 82 services, then fixed, retested them with the Cybersecurity Agency and restored them gradually, with 21 still unavailable on 30 October. Risky Business adds that this is Moldova’s second major breach this year, after a healthcare database in April.
Staying Safe
AGE urges all citizens to treat unexpected calls, SMS messages and emails with suspicion, never share passwords or authentication codes, avoid unsolicited links, and refuse payments requested by strangers. AGE also notes that a caller knowing your name and IDNP does not prove they represent an institution. Unusual requests should be checked through official channels, and unrecognised transactions reported to the service provider immediately.
