Moldova Investigates Foreign State-Sponsored Cyberattack on Government Systems

Moldova is currently investigating a major cyberattack that compromised its government systems, leading to the potential exposure of sensitive personal data and disruption of numerous public services. Prime Minister Vasile Tofan indicated that the incident may be part of a larger, coordinated campaign with possible foreign state actor involvement, emphasizing that it was "not an isolated incident."

The attack, which occurred between October 19 and October 23, saw hackers exploit vulnerabilities in government services that did not require authentication. Through approximately 11 million requests, attackers managed to extract large volumes of personal information. Preliminary findings suggest data linked to around 750,000 identification numbers was accessed, though not all individuals had every category of data compromised. The compromised information could include names, dates and places of birth, family relationships, health insurance status, pension details, disability records, driver's licenses, photographs, and vehicle ownership information. While financial data like bank account numbers and tax histories may have been accessed, authorities confirmed that bank card information was not affected, and no official government records were altered.

Authorities have temporarily disconnected over 30 government information systems and administrative panels, along with 82 digital public services deemed vulnerable. This action caused disruptions to various services, including online applications for construction permits, veterinary transport authorizations, medicine imports, and food safety registrations. While most affected services have since been secured and access is being gradually restored after additional security checks, the government warned that the stolen data could be used in sophisticated fraud schemes, such as impersonating banks or public institutions to solicit passwords, authentication codes, or money.

The Electronic Governance Agency (AGE) disclosed that while unauthorized access was blocked on October 23, additional, unsuccessful attempts to breach government services were detected on subsequent days. The government spokesperson, Dumitru Ciorici, suggested the incident could be part of a broader campaign of hybrid attacks targeting Moldova. This is not the first time the nation has faced such threats; since Russia's full-scale invasion of Ukraine in 2022, Moldova, situated between Ukraine and Romania, has been a frequent target of cyberattacks and influence operations.

Moldovan authorities have previously accused Russia of orchestrating destabilization campaigns aimed at undermining state institutions and eroding public confidence in the country's pro-European government led by President Maia Sandu. The current investigation is focused on uncovering the full scope of the breach and definitively attributing the attack to specific actors.

The incident highlights the persistent threat landscape faced by Eastern European nations, particularly those with geopolitical ties to Western alliances and those bordering conflict zones. The sophistication of the attacks, coupled with the potential for foreign state sponsorship, underscores the need for robust cybersecurity defenses and international cooperation in combating cyber threats.