Source: MOLDPRES / STISC

Moldova is dealing with one of the largest cyberattacks on its government infrastructure in years. Between 19 and 23 October 2026, attackers queried approximately one million personal identification numbers (IDNPs) in an attempt to extract personal data without authorisation, and preliminary estimates show data sets linked to around 750,000 people were extracted, according to the country’s Information Technology and Cyber Security Service (STISC) and Electronic Governance Agency (AGE). In a country of only about 2.4 million people, that is close to one in three residents.

A national security level response

President Maia Sandu has convened a meeting of the National Security Council for the coming days to assess the attack and determine response measures, the presidency announced on 28 October. Prime Minister Vasile Tofan told a government meeting that there are indications of a broader campaign involving foreign state actors, and that the relevant authorities are investigating their involvement in the recent incident. The director of AGE, Nicoleta Colomeet, was dismissed, with the prime minister asking the institution to place greater emphasis on the security of digital services.

What was taken

The targeted information includes names, dates of birth, insurance status and health information, as well as financial information including IBANs, according to AGE. The agency warns that the main risk is the use of this data in attempted fraud and online manipulation. In practice, criminals can combine these genuine personal details with social engineering to impersonate banks or government agencies, which makes their messages far more convincing than generic spam.

Lessons for every European organisation

The Moldova incident is a reminder that citizen facing digital services are a prime target, and that a breach of one government platform can expose a third of a population. For organisations holding customer data, the same fundamentals apply: know which of your services are exposed to the internet, monitor for abnormal query volumes, segment access to personal data, and have an incident response plan that can be executed within hours rather than days. NIS2 and GDPR obligations in the EU make documented readiness a legal requirement, not a best practice. If your organisation needs help hardening public facing services, reviewing data access controls or preparing incident response and breach notification procedures, contact us for professional advice.