Moldovan President Maia Sandu has called a meeting of the country's National Security Council after a large-scale cyberattack on government information systems resulted in the extraction of personal data belonging to roughly 750,000 Moldovans, in an attack most likely carried out with the help of artificial intelligence.
Sandu's office announced on October 29 that the council would meet "in the coming days to assess the attack and determine appropriate response measures." A day earlier, Prime Minister Vasile Tofan told cabinet ministers that there were "indications of a broader campaign involving foreign state actors" and that investigators were looking into "their involvement in the recent incident," without specifying which countries were suspected.
Officials from several European nations have for months warned of an expanding campaign of hybrid activity by Russia amid its war on Ukraine: hostile actions short of open warfare, including cyberattacks, sabotage and the weaponization of migration. Moldova, wedged between NATO member Romania to the west and war-ravaged Ukraine to the east, has struggled to shield itself from the fallout of Moscow's full-scale invasion.
According to Moldova's Electronic Government Agency (AGE), the attack targeted about one million people, almost half of the country's population, with attempts to extract data associated with personal identification numbers taking place between October 19 and October 23. Authorities have preventively suspended 82 digital public services and disconnected more than 30 information systems to limit unauthorized access.
The compromised data could include names and dates and places of birth, information about immediate family members, health insurance status and family doctors, social benefits, pensions and disability status, driver's license details and photographs, vehicles and companies owned or managed, and financial information including International Bank Account Numbers, tax debts and payment histories. AGE said bank card data was not affected and no unauthorized changes were identified in state registers.
The attackers allegedly exploited vulnerabilities in services accessible without authentication, then used the information obtained to attempt additional data extraction. Authorities said security problems had been addressed in most affected services, with the remaining ones to be restored gradually once security measures had been verified. A broader review of government systems was under way to identify and fix vulnerabilities. The agency warned that cyberattacks pose a growing threat to public institutions, with advances in artificial intelligence making it easier to automate attacks and identify security weaknesses.
Analysis
Why This Matters
- The stolen records could include national identification numbers, health, pension and financial details for roughly 750,000 people, a trove that enables identity fraud and targeted pressure on individuals over time.
- The breach carries an interstate dimension: investigators are examining foreign state actors' involvement, and it comes amid repeated European warnings of a Russian hybrid campaign around the war in Ukraine.
- The practical fallout continues: 82 digital public services remain suspended and more than 30 information systems disconnected, with some services awaiting restoration once security checks are verified.
Background
Moldova, a former Soviet republic of roughly 2.6 million people, sits between EU and NATO member Romania and Ukraine and has pursued closer ties with the West while facing sustained pressure from Moscow. European officials have warned that Russia is waging a hybrid campaign against the region using cyberattacks, sabotage and migration as tools, the context in which Moldovan authorities are now investigating this breach.
Key Perspectives
President Maia Sandu's office: says the National Security Council will meet "in the coming days to assess the attack and determine appropriate response measures."
Prime Minister Vasile Tofan: sees "indications of a broader campaign involving foreign state actors" and says investigators are looking into "their involvement in the recent incident."
Officials from several European nations: have warned for months that Russia is running an expanding campaign of hybrid activity, hostile actions short of open warfare, while it wages war on Ukraine.
Moldova's Electronic Government Agency (AGE): warns that cyberattacks pose a growing threat to public institutions and that advances in artificial intelligence make it easier to automate attacks and identify security weaknesses.
What to Watch
- The National Security Council meeting in the coming days and the response measures it approves.
- Whether investigators publicly identify the foreign states suspected of involvement.
- The completion of the government-wide security review and the full restoration of suspended public services.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedPresident Maia Sandu called a National Security Council meeting after the cyberattack.RFE/RL: “Moldovan President Maia Sandu has convened a meeting of the country's National Security Council (CNS) days after a large-scale cyberattack on government information systems.”
- SupportedThe attack resulted in the extraction of personal data belonging to approximately 750,000 Moldovans.RFE/RL: “The attack, most likely carried out with the help of artificial intelligence, resulted in the extraction of personal data belonging to approximately 750,000 Moldovans.”
- SupportedPrime Minister Vasile Tofan cited “indications of a broader campaign involving foreign state actors.”RFE/RL: “Prime Minister Vasile Tofan told cabinet ministers that there were "indications of a broader campaign involving foreign state actors"”
- SupportedAuthorities suspended 82 digital public services.RFE/RL: “Authorities have preventively suspended 82 digital public services and disconnected over 30 information systems to limit unauthorized access, it added.”
- SupportedThe attack was most likely carried out with the help of artificial intelligence.RFE/RL: “The attack, most likely carried out with the help of artificial intelligence, resulted in the extraction of personal data belonging to approximately 750,000 Moldovans.”
- SupportedSandu's office said the council would meet “in the coming days to assess the attack and determine appropriate response measures.”RFE/RL: “On October 29, Sandu's office announced that the meeting would take place in "the coming days to assess the attack and determine appropriate response measures."”
- SupportedTofan said investigators were looking into “their involvement in the recent incident.”RFE/RL: “A day earlier, Prime Minister Vasile Tofan told cabinet ministers that there were "indications of a broader campaign involving foreign state actors" and that investigators were looking into "their involvement in the recent incident."”
- SupportedThe attack targeted about one million people, almost half the country's population.RFE/RL: “According to Moldova's Electronic Government Agency (AGE), the attack targeted about one million people , almost half of the country's population”
- SupportedAttempts to extract data associated with personal identification numbers took place between October 19 and October 23.RFE/RL: “with attempts to extract data associated with personal identification numbers (IDNPs) taking place between October 19 and October 23.”
- SupportedAuthorities disconnected more than 30 information systems to limit unauthorized access.RFE/RL: “Authorities have preventively suspended 82 digital public services and disconnected over 30 information systems to limit unauthorized access, it added.”
- SupportedAGE said bank card data was not affected and no unauthorized changes were identified in state registers.RFE/RL: “AGE said bank card data was not affected and that no unauthorized changes were identified in state registers.”
- SupportedAuthorities said the remaining affected services would be restored gradually after security measures were verified.RFE/RL: “Authorities said security problems had been addressed in most affected services, while the remaining ones would be gradually restored once security measures had been verified.”
