Cyberattack on Moldova's digital services: 11 million requests for citizens' data
Several digital public services in the Republic of Moldova were the target of a large-scale cyberattack, involving approximately 11 million access requests aimed at the illicit acquisition of personal data. The incident occurred on the night of October 22, and authorities halted the attack the following day. Authorities warn that some government platforms may experience operational difficulties or be temporarily unavailable while security checks continue.
Monitoring systems identified the attack after they recorded unusual activity related to access to public services, as well as a suspicious number of database queries. To prevent unauthorized access to information, the authorities decided to take the affected services offline as a precautionary measure. The E-Governance Agency (AGE), the Information Technology and Cyber Security Service (STISC), and the Cyber Security Agency (ASC) released this information on Saturday, October 24.
According to these institutions, the attack aimed to extract citizens' personal data; however, they have not yet disclosed whether the attackers succeeded in obtaining it. The authorities have not specified which platforms were targeted or identified who might be behind the incident.
The police and the National Center for Personal Data Protection have been notified of the attack. An investigation is underway, and specialists are continuing efforts to secure the IT systems—work that will continue through the weekend. Consequently, citizens may have difficulty accessing certain online public services.
At the same time, authorities warn of the risk of fraud attempts in which criminals use personal data to gain victims' trust. Scammers may pose as employees of public institutions or banks, citing an individual's name or personal identification number (IDNP) to make the call seem official.
"The fact that the caller possesses this information does not mean they represent an official institution," the authorities warn. Citizens are urged not to share passwords, authentication codes, or other confidential information via telephone or messages, and not to authorize transactions requested by unknown individuals. Public institutions do not ask for such information through these communication channels.
