Identity

Between October 19 and 23, 2026, attackers pulled personal data out of Moldova's government digital services by calling online services that asked for no login, then feeding what they got into other, interconnected state systems. Moldova's Electronic Governance Agency (AGE) and the Information Technology and Cyber Security Service (STISC) say the attackers sent about 11 million data requests, queried about one million personal identification numbers (IDNPs, the number every Moldovan resident carries) and, on preliminary findings, extracted data linked to about 750,000 of them.

The extraction was stopped on October 23, and authorities took 82 public digital services and more than 30 information systems and administration panels offline as a precaution. Prime Minister Vasile Tofan said on October 28 that investigators are examining possible involvement by a foreign state. Nobody has been named. For anyone who runs public-facing services backed by a national ID or customer number, this matters directly: a single endpoint that answers anonymous queries can become the entry point to every system that trusts it.

How it works

AGE describes two steps. First, the attackers found electronic services that could be used without authentication. Such services typically take an identifier, such as an IDNP, typed into a public form or sent to the form's backing API, and return a status or a record. Second, they used the data those services returned to request more data from interconnected government systems. In practice that most likely means a field from one answer (a relative's IDNP, a vehicle record, a licence number) becomes the input for the next query somewhere else, so a single starting number fans out into a family, a car, a pension file and a payment history.

What came out shows how far that fan-out reached. Authorities list identities and first-degree relatives, dates and places of birth, health insurance status and family doctor, pensions, social benefits and disability records, driving licence data and photographs, vehicles, companies owned or managed, and some financial data: IBAN account numbers, tax debts and payment history from MPay, the state payments portal.

The ratio of requests to people is telling. About 11 million requests for about one million IDNPs works out to roughly 11 requests per number, which fits a script that walks each person through several linked services. That is our arithmetic, not an official finding. So is this one: over the four and a half days to 11:30 on October 23, 11 million requests average out to roughly 28 a second, a rate no citizen using a permit form produces.

Moldovan outlet Cotidianul, reporting STISC's statement, adds one detail that shows the inter-system trust at work. One government service recorded the wrong legal basis for its data processing, which is why some citizens saw entries in the access history of EVO, the government's citizen app, for civil status documents or driving licences they had never requested.

Authorities have not said which services lacked authentication or where the attackers got their IDNPs. Moldova1, the public broadcaster, reports that investigators are also examining whether artificial intelligence was used to find the weak points. Treat both the method and the AI angle as unconfirmed until the investigation reports.

What attackers are doing

Unauthorised extraction stopped at 11:30 on October 23. Cotidianul reports a new attempt to force access around 02:00 on October 25 and another around 07:00 on October 27; The Record also reports failed attempts on those two days. Authorities say they found no unauthorised changes to state registry data, bank card data was not exposed because card payments run through banks' own infrastructure, knowing an IBAN does not allow anyone to withdraw money, and seeing property or company records does not allow anyone to transfer ownership.

The Record reports that the disconnected services included online applications for construction permits, veterinary transport authorisations, medicine imports and food safety registrations, and that most are back after further checks. Government spokesperson Dumitru Ciorici said, according to The Record, that the attack could be part of a wider hybrid campaign. Moldova1 reports that President Maia Sandu will convene a National Security Council meeting. No group has claimed the attack.

The immediate risk is fraud. The government warns that criminals can now phone or message people while quoting their family members, pension, car or bank details, posing as a bank or a public institution to get passwords, one-time codes or payments. Messages about a relative in trouble are specifically mentioned.

What to do

If you serve Moldovan customers or staff

Treat an IDNP, date of birth, relatives' names and an IBAN as known to criminals for hundreds of thousands of people. Remove any helpdesk, phone banking or account recovery step that accepts those details as proof of identity, and use a login with a second factor or a callback to a number already on file instead. Warn customer-facing staff that a caller who recites someone's family and pension details is now more likely to be a fraudster.

If you run public services that take an ID number

The following steps are general guidance drawn from how this attack is described, not instructions from Moldovan authorities.

1. List every endpoint that answers without a session, including the API calls behind public forms and any admin panel reachable from the internet.
2. For each one, ask what a stranger gets back for an ID number that is not theirs. A status check that returns "valid" or "not found" already confirms which numbers exist. A response that includes a relative's ID, a licence number or an IBAN is worse, because it feeds the next query. Return only the minimum, or put the lookup behind a login.
3. With no credential to throttle, limit per client instead: per IP address and network block, per device fingerprint, and per session cookie, with a CAPTCHA or proof-of-work challenge once a client passes a handful of distinct ID numbers. Make the gateway reject excess requests, not just log them.
4. Log the queried identifier (hashed if needed), client IP, user agent, endpoint, response size and outcome for every anonymous call. Alert on the count of distinct ID numbers per client per hour, on total anonymous volume against a weekly baseline, and on one ID number appearing across several services within minutes, which is the chaining pattern.
5. Make back-end registers verify the caller. When a front-end service queries a register, the register should check that the call carries an authenticated end user or a case reference, and should refuse bulk lookups from a front end that has no session. A shared service account that can read any record for any request is how one weak form exposes many systems.
6. Show citizens or customers who accessed their data, as EVO does, and give them a way to report lookups they did not make. That log is how some Moldovans spotted the problem.

If you find a client that matches these patterns, block it at the edge first, then work out which records it received and treat every one as disclosed.

The wider lesson

Public e-services are often reviewed one at a time, by the team that built each form, while the registers behind them assume any internal caller is legitimate. This attack crossed those boundaries by turning the output of one service into the input of the next. Testing should follow the same path: start from what an anonymous user can see and keep asking which other system will accept it.

Our web penetration tests try exactly that kind of enumeration and chaining against public portals and their APIs, and our attack surface management work keeps an up-to-date list of exposed endpoints and admin panels. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: The Record, Moldova1, Cotidianul.