Moldova investigates possible foreign state role in identity database cyberattack

Moldova's prime minister said on 3 November that authorities are investigating possible involvement by a foreign state in the cyberattack on government databases. He declined to identify a suspected government, EU Today reported. No perpetrator has been identified, and prosecutors have opened a criminal investigation.

According to the government's account, attackers queried about one million personal identification numbers between 19 and 23 October. They obtained at least one element of associated information in about 750,000 cases. Prime Minister Vasile Tofan cautioned that this did not necessarily mean 750,000 individual accounts had been compromised. The extracted information could include names, surnames or years of birth.

Biometric Update reported that possible exposed fields include names, birth details, health insurance status, bank account numbers and tax information. Mihai Lupascu, head of the country's Cybersecurity Agency, called the operation highly sophisticated and said it affected about one-third of the resident population.

The government temporarily disconnected vulnerable systems to contain the threat and is restoring services after security audits. President Maia Sandu scheduled an emergency meeting to address the crisis and determine future security measures, Biometric Update reported. Attackers exploited government services that did not require authentication to extract sensitive records.

Why one number mattered

Cybersecurity specialists have focused on Moldova's individual identification number, the IDNP, and its use across government databases. Sergiu Bozianu, a data protection specialist cited by Moldova's public broadcaster, identified weaknesses in the centralisation of services and insufficient separation of personal identifiers between systems, EU Today reported. That architecture made one number useful across many databases and increased the potential consequences of unauthorised access.

Timing and next steps

The breach landed shortly after Brussels and Chisinau opened additional chapters in EU accession negotiations on 13 October, covering the internal market, competitiveness and economic development. Moldova's membership process began formally in 2022. Moldova received a further €189 million in March 2026 under the EU's Reform and Growth Facility after progress on reforms including cybersecurity and digitalisation of public services, EU Today reported.

Moldova has not attributed the attack to Russia. Moscow has previously been accused of political interference and destabilisation operations in Moldova, but historical allegations cannot establish responsibility for this intrusion, EU Today reported. Authorities must still determine how the databases were accessed, whether vulnerabilities were exploited repeatedly and whether the operation was part of a wider campaign.

The criminal investigation gives prosecutors a legal framework for examining the extraction of personal information. The government is still restoring services after security audits.