Hackers stole data on 750,000 Moldovans from online public services

Eighty-two online public services cut off at once, more than thirty information systems unplugged: that is the precautionary measure Moldova's e-Governance Agency (EGA) had to take. Between October 19 and 23, 2026, attackers queried its platforms and extracted data tied to roughly 750,000 personal identification numbers (IDNP).

According to the EGA, the attack targeted about one million people, nearly half of the country's population. The attackers reportedly first exploited flaws in services accessible without authentication, then used the data they obtained to try to extract more.

Pensions, driver's licenses, IBANs: what may have leaked

According to the agency's initial findings, reported by Radio Free Europe/Radio Liberty (RFE/RL) and the Moldovan outlet ZDG, the files touch nearly every aspect of the affected people's administrative lives: name, date and place of birth, close family members, health insurance and primary care doctor, social benefits, pensions and disability, driver's licenses and photos, and vehicles and companies owned. On the financial side, IBANs, tax debts and the history of payments made on the MPay public platform may have been exposed.

The EGA says, however, that bank card data is not affected and that no fraudulent changes have been found in state registers. On October 28, its director, Nicoleta Colomeeț, announced her resignation, stating that she was leaving on her own initiative, according to ZDG.

Did AI help find the flaws?

Mihai Lupașcu, head of Moldova's cybersecurity agency, describes a "highly sophisticated," "well-prepared" operation carried out "in several waves." He believes artificial intelligence was used, notably to spot vulnerabilities, and warns that these tools "will continue to generate cyber incidents in the coming years." He did not detail the evidence behind this belief.

The question of who is responsible remains open. Mr. Lupașcu considers it "premature" to name a culprit. Prime Minister Vasile Tofan cites "signs of a broader campaign involving foreign state actors," without naming a country. President Maia Sandu's office announced a meeting of the Supreme Security Council to assess the attack and decide on a response.

The scenario recalls other recent attacks in which AI served as an accelerator, such as that of a former South Korean security expert accused of hacking 90 organizations.

The lesson for European administrations

The starting point, according to the official account: flaws in public services accessible without authentication. A few simple checks follow from this:

• inventory the interfaces (APIs, lookup forms) that return personal data without authentication;
• limit the number of requests per source and alert on serial queries of consecutive identifiers;
• verify that data retrieved from one service cannot be used to query another.

For residents, the immediate risk is targeted phishing: with an IBAN, family data and a payment history, a scammer can convincingly pose as a government agency or a bank. What happens next now depends on the investigation: attribution, and whether the files are eventually published.