Summary
- Environment: Moldovan public digital services
- Operational impact: Services disconnected during containment; recovery subject to security checks
- Financial impact: No confirmed financial loss quantified
- Record status: Developing record. Reviewed October 29, 2026; updated as evidence emerges.
What happened
Moldova’s Electronic Governance Agency disclosed an attack on public digital services on October 24, 2026. Its initial warning described the night of October 22 and approximately 11 million access requests. That request volume is not a victim count. [2]
Impact
The October 27 findings expanded the window to October 19–23: about one million IDNP identifiers were queried and datasets linked to roughly 750,000 were extracted. These preliminary figures measure different populations. [1]
Exposed categories included identity, family, health, benefits, disability, licence, photograph, asset and financial details. Exposure varied by person. Authorities reported no affected bank-card information or identified unauthorized register changes. [1]
Timeline
Revised extraction window begins
The later investigation extends the earlier account.
[1]Extraction stopped
Authorities disconnected 82 services and more than 30 systems and administration panels.
[1]Public warning issued
The first announcement warned of impersonation fraud and temporary service disruption.
[2]Preliminary scope published
Authorities reported another unsuccessful extraction attempt.
[1]Briefing updated
This briefing was last reviewed and updated on October 29, 2026.
Threat Group & Attack Vector
Attackers exploited unauthenticated services and reused obtained data for further extraction. No specific vulnerability is identified. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1190 — Exploit Public-Facing Application: vulnerable public services enabled extraction. [1]