A large extraction with a narrower meaning than hacked accounts
Moldova's E-Governance Agency, AGE, says attackers extracted data linked to about 750,000 personal identification numbers during an intrusion into public digital services. Its preliminary review found attempts to query roughly one million unique IDNPs between 19 and 23 October. The number describes people whose identifier was tied to at least one extracted item, according to Prime Minister Vasile Tofan. It does not mean 750,000 login accounts were taken over or that every category of data was obtained for each person.
AGE says it stopped unauthorized extraction at 11:30 on 23 October and later blocked further attempts. Eleven public services were back online after security testing by 27 October. These are concrete containment and restoration milestones, while the full audit and individual notifications remain pending. The attacker has not been publicly identified. Tofan says possible foreign-state involvement and AI assistance are being investigated, not established findings.
Key takeaways
- AGE preliminarily counts data linked to about 750,000 IDNPs extracted after roughly one million unique identifiers were queried. That figure is not a count of compromised accounts.
- AGE reports stopping extraction on 23 October, checking and preventively disconnecting 82 services alongside more than 30 systems or panels, then restoring 11 tested public services by 27 October. These are different categories and dates.
- Officials say no bank-card data were affected and no unauthorized register changes were found. The scope of each person's exposure, any resulting fraud, and the attacker remain unresolved.
How public services became a source of personal details
AGE says vulnerabilities in services accessible without authentication let the attackers obtain data, then use what they found to extract more. Its public account does not identify the precise software flaw or the complete sequence of systems reached. The agency also says an early service incorrectly recorded the legal basis for some processing, confusing what users saw in their EVO access history. That logging problem makes a screen in a user's account an imperfect guide to the actual extraction path.
The categories AGE lists may include birth and family details, insurance and medical-provider information, benefits, driving licences and photos, vehicles, business affiliations, IBANs, tax debts and payment history. The agency cautions that no one should assume all these fields were exposed for every IDNP. It says bank-card data were not affected and investigators had found no unauthorized modifications to state registers as of 27 October. An IBAN in a copied record is sensitive, though it is not by itself a payment authorization.
What the shutdown and reopening show
Authorities first noticed abnormal requests on the night of 22 October. The joint agencies reported about 11 million access requests and precautionary disconnections. AGE later said it checked and preventively disconnected 82 services, alongside more than 30 information systems or administrative panels, on 23 October. Those numbers count different things: requests received, public services disconnected and systems or panels disconnected. Treating these figures as one outage count would hide which public functions people could use at each point.
On 27 October, AGE and its partner agencies restored 11 public services after testing, including criminal-record and certain civil-status and register extracts through EVO. The reported 11 restorations measure service availability, not how many people's details were taken. The releases do not provide a complete list of every still-unavailable service or a measure of users unable to complete transactions during the shutdown. AGE also reports blocking renewed extraction attempts around 25 and 27 October. That shows further attempted access was detected, while the incident audit still has to test whether other routes remain open.
“The reported 11 restorations measure service availability, not how many people's details were taken.”
The fraud risk and the unanswered attribution
Authentic identifiers, family relationships or benefit details can make a caller impersonating a bank or state office sound credible. AGE and Tofan warn of that social-engineering risk. It is a reason to scrutinize requests for money or credentials that cite real personal facts, not evidence that a known number of victims have already been defrauded. AGE has promised individual notification, but its opened statements do not confirm how many people had been notified by 30 October. A notice tied to the actual fields exposed would give recipients more useful guidance than the aggregate IDNP count.
At a 28 October government meeting, Tofan said investigators were considering possible foreign-state involvement and AI-assisted exploitation. He named no state or technical indicator. High-volume queries show scale, but do not establish AI use or direction by a government. The Record likewise reports that no country or group has been publicly attributed.
Moldova can currently demonstrate preliminary extraction linked to about 750,000 IDNPs, a reported halt to that extraction, blocked later attempts and the return of 11 tested services. It has not shown that 750,000 accounts were compromised, that state registers were altered or that a named actor directed the attack. A completed per-person audit and notification record would define the exposure. Service logs and independent retesting would establish the duration and reach of any disruption. A forensic report linking the access path to identified operators, with evidence for any claimed AI role, would change the attribution judgment.
Share this analysis
Mara Ionescu
Research ContributorInformation resilience, foreign influence narratives, and regional security in Romania, Ukraine, and the Republic of Moldova.
View contributor profile →
