--- title: "Moldova government digital-services data extraction" description: "Moldova disclosed unauthorized extraction from government digital services and suspended exposed systems." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-29" canonical_url: "https://www.ally.security/incidents/moldova-government-digital-services-data-extraction-2026" markdown_url: "https://www.ally.security/incidents/moldova-government-digital-services-data-extraction-2026.md" stix_url: "https://www.ally.security/incidents/moldova-government-digital-services-data-extraction-2026/stix.json" --- # Moldova government digital-services data extraction Authorities revised their preliminary scope to datasets associated with approximately 750,000 IDNP identifiers. Last modified Oct 29, 2026 · 2 sources ## Summary - **Environment:** Moldovan public digital services - **Operational impact:** Services disconnected during containment; recovery subject to security checks - **Financial impact:** No confirmed financial loss quantified ## What happened [Moldova’s Electronic Governance Agency](https://egov.md/) disclosed an attack on public digital services on October 24, 2026. Its [initial warning](https://egov.md/ro/node/41141) described the night of October 22 and approximately 11 million access requests. That request volume is not a victim count. [2](#source-2) ## Impact The [October 27 findings](https://egov.md/ro/node/41145) expanded the window to October 19–23: about one million IDNP identifiers were queried and datasets linked to roughly 750,000 were extracted. These preliminary figures measure different populations. [1](#source-1) Exposed categories included identity, family, health, benefits, disability, licence, photograph, asset and financial details. Exposure varied by person. Authorities reported no affected bank-card information or identified unauthorized register changes. [1](#source-1) ## Timeline ### October 19, 2026 — Revised extraction window begins The later investigation extends the earlier account. [1](#source-1) ### October 23, 2026 — Extraction stopped Authorities disconnected 82 services and more than 30 systems and administration panels. [1](#source-1) ### October 24, 2026 — Public warning issued The [first announcement](https://egov.md/ro/node/41141) warned of impersonation fraud and temporary service disruption. [2](#source-2) ### October 27, 2026 — Preliminary scope published Authorities reported another unsuccessful extraction attempt. [1](#source-1) ### October 29, 2026 — Briefing updated This briefing was last reviewed and updated on October 29, 2026. ## Threat Group & Attack Vector Attackers exploited unauthenticated services and reused obtained data for further extraction. No specific vulnerability is identified. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/): vulnerable public services enabled extraction. [1](#source-1) ## Response Services were being restored after remediation and security retesting; investigation continued. [1](#source-1) Authorities advised citizens to verify unexpected contacts and never share passwords or authorization codes with unsolicited callers. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Aproximativ un milion de IDNP-uri vizate în tentative de extragere a datelor cu caracter personal official · Agenția de Guvernare Electronică ### Autoritățile au blocat un atac cibernetic asupra mai multor servicii publice digitale. Investigația continuă official · Agenția de Guvernare Electronică
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: AGE preliminarily estimated that approximately one million IDNP identifiers were queried and datasets associated with approximately 750,000 IDNPs were extracted during October 19–23. These are distinct queried and extracted populations; the investigation remained ongoing. 2. **Affected Organization · 100% confidence · current** Moldova government digital-services data extraction: Government of Moldova 3. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Further attempts were blocked on October 25 and October 27. Most affected services had been remediated by the October 27 notice, with restoration conditional on security retesting. 4. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Preliminary scope and technical findings published 5. **Occurred At · 100% confidence · current** Initial public warning: 2026-10-24 6. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Attackers exploited vulnerabilities in services accessible without authentication and used obtained data for further extraction. The notice identifies no CVE or attacker. 7. **Occurred At · 100% confidence · current** Start of revised extraction window: 2026-10-19 8. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Authorities stopped extraction at 11:30 on October 23 and preventively disconnected 82 public services and more than 30 information systems and administration panels. The notice does not specify the time zone. 9. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Initial public warning 10. **Used Attack Technique · 100% confidence · current** Moldova government digital-services data extraction: https://attack.mitre.org/techniques/T1190/ 11. **Occurred At · 100% confidence · current** Preliminary scope and technical findings published: 2026-10-27 12. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Start of revised extraction window 13. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: AGE said bank-card information was not affected and investigators had not identified unauthorized changes to state-register data. 14. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Extraction stopped and services disconnected 15. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: The October 24 announcement described an attack on the night of October 22 and approximately 11 million access requests against public digital services. Request counts are not affected-person counts. 16. **Began At · 100% confidence · current** Moldova government digital-services data extraction: 2026-10-19 17. **Disclosed At · 100% confidence · current** Moldova government digital-services data extraction: 2026-10-24 18. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Exposed categories included identity and first-degree family information, insurance and healthcare details, social benefits, disability, driving licences, photographs, vehicles and companies, IBANs, tax debts and MPay payment history. Not every affected person had every category exposed. 19. **Occurred At · 100% confidence · current** Extraction stopped and services disconnected: 2026-10-23 20. **Resulted In · 100% confidence · current** Moldova government digital-services data extraction: Authorities warned that stolen identifiers could support impersonation fraud and advised citizens not to share passwords or authorization codes with unsolicited callers. Police and the data-protection authority were informed.