Data of three-quarters of a million people stolen in Moldova – the haul could be a goldmine for Moscow

Hackers who attacked Moldova's state systems obtained the personal data of about 750,000 people, having had access to sensitive information for several days. The authorities have not yet named the perpetrators, but in the case of a country that has been exposed to Russian hybrid warfare for years, the possibility of an operation linked to the Kremlin is quite obvious. The stolen data can be used not only for financial fraud but also for intimidation, blackmail and tailored political manipulation.

The attack took place between October 19 and 23. According to Moldova's Information Technology and Cybersecurity Service, STISC, the perpetrators queried roughly one million personal identification numbers and extracted the data of about three-quarters of a million people. That is nearly a third of the population of this country of two and a half million — in other words, a data loss on a scale whose consequences could follow those affected for many years to come.

The intruders exploited vulnerabilities in state services that were accessible even without authentication. The information that could be obtained included identity and family data, insurance status, family doctor affiliations, social benefits, pensions and disability status. They could also access driving-license-related data and photographs, information on vehicles and on companies owned or managed by individuals, as well as bank account identifiers, tax debts and payment histories in the MPay system. Not all of this data was exposed for every person affected, but even so, the potential haul could provide a shockingly detailed picture of people's lives.

The data extraction was halted on the morning of October 23, at 11:30 a.m., and the E-Government Agency (AGE) shut down 82 public services and more than thirty IT systems as a precaution. The attackers made further attempts afterward: new intrusion attempts were detected early on October 25 and on the morning of October 27, but according to the statement these were successfully blocked. STISC stressed that no bank card data was leaked, since the government platform in question does not store such information. Knowing an IBAN number alone does not make it possible to empty an account, and no unauthorized changes were found in the state registries either. So the fact that data on properties or businesses could be viewed does not mean anyone's ownership rights were altered. Still, this does not make the story reassuring. One of the most dangerous consequences of a data theft is precisely that a scammer can list details from the victim's life that people instinctively associate with the knowledge only a real office, bank or authority would have. If the caller knows your relatives, your pension, your car or your tax debt, it becomes easier to believe that they really are calling from where they claim to be.

According to analyst Ion Tăbârță, the attack clearly exposed the shortcomings of the state's digital defenses. As he put it, Moldova's cybersecurity is not as advanced as people believed, or as it was presented to be. With the genuine data obtained, the attackers can reach people by phone, SMS and social media, posing as bank employees, police officers or staff of other state institutions, in order to extract further information or money from them. In Moldova's case, however, one has to look beyond that. In a country where the Kremlin has for years been trying to shape politics through election interference, vote-buying, disinformation and energy blackmail, the security-policy significance of a dataset of this size can hardly be overstated. For the Russian services or networks cooperating with them, a collection revealing who is financially vulnerable, who receives what kind of support, who their relatives are, and what personal circumstances could be used to pressure them, can be especially valuable. Whoever holds this much personal information no longer needs to pour the same clumsy propaganda text over everyone. A pensioner can be frightened through concerns about their livelihood, an indebted entrepreneur can be approached with a different story, and someone worried about their family can be reached through a lie tailored to their relatives. In this genre, personal data is a targeting tool: it helps find the point where a person can most easily be shaken.

According to cybersecurity expert Natalia Spînu, the attack also undermines trust in institutions, and defense needs to start with people and procedures, with technology then built on top of these. Citing publicly available information, she said that around fifteen specialists were working on protecting the country's systems at the time of the incident. They did important work, but a state cannot rely on such a small team: it needs an adequate number of specialists and salaries that are good enough to retain them. It should likewise be clearly established who is responsible for maintaining and overseeing each service, for emergency shutdowns, and for informing the public. According to Spînu, for every service it must be checked who is requesting data and whether they are authorized to access it, and the number of queries must be limited, so that an interface meant for citizens' everyday administrative needs cannot be turned into a channel for mass data extraction.

The case has already had personal consequences: Nicoleta Colomeeț, head of the AGE, has resigned, and Artiom Cociu has been appointed in her place on an interim basis. At the handover, Prime Minister Vasile Tofan spoke of restoring the trust that had been lost, the Prosecutor General's Office has launched a criminal investigation, and parliament's national security committee will examine the case at a closed session on November 4.

Alongside identifying those responsible and closing the gaps, what is now also at stake is how capable Moldova is of protecting the people whose data has already leaked from state systems. A haul like this could be a goldmine for the Kremlin, and the erosion of trust in institutions benefits it regardless of who ultimately turns out to be behind the actual data theft. That is precisely why the attack must be investigated, the danger of Russian exploitation taken seriously, and accountability demanded for how the system safeguarding citizens' data could have remained so vulnerable.

Ugar