Attack on digital public services: what data was extracted, how to check in EVO and what you can do now

The cyberattack on the state’s digital public services, which took place between 19 and 23 October 2026, led to the unauthorised extraction of personal data sets associated with around 750,000 IDNPs, according to preliminary estimates by the e-Governance Agency (AGE). Around one million IDNPs were queried during the same period. The authorities say that data in state registers was not altered and that information about bank cards was not affected. The main risk to citizens is the use of their data in fraud attempts.

In brief

• The figures are preliminary: around one million IDNPs were queried and data sets relating to around 750,000 people were extracted. Prime Minister Vasile Tofan said this means at least one data element was extracted in each case, not that 750,000 accounts were hacked.

• The data comes from state registers, not the EVO app. People who do not use EVO may also be affected.

• There is no need to replace your identity document, because your IDNP remains the same on a new document.

• AGE is working on a mechanism to notify affected people individually, but it has not yet been announced.

• The Chișinău Prosecutor’s Office has launched a criminal investigation. The perpetrators of the attack have not been officially identified.

What happened

AGE, the Information Technology and Cyber Security Service (STISC) and the Cyber Security Agency (ASC) announced the incident on 24 October. According to their statement, the authorities detected unusual activity involving access to digital public services and data queries. Around 11 million access requests were recorded, made with the aim of unlawfully obtaining personal data.

AGE’s technical explanation, published on 27 October, says that the attackers exploited vulnerabilities in services accessible without authentication and then used the data obtained to carry out further extractions. Prime Minister Vasile Tofan said at a government meeting on 28 October that the extraction was automated and that some vulnerabilities could have been identified with the help of artificial intelligence.

ASC Director Mihai Lupașcu told Europa Liberă that, in terms of its impact, this was “the largest cyberattack recorded so far” in the Republic of Moldova. According to him, “this was not an opportunistic attack, but a sophisticated, well-prepared attack”.

What data was targeted

According to AGE, the extracted data may include:

• identification data: first name, last name, date and place of birth, photograph;

• data about first-degree family members;

• insured status, family doctor, social benefits, pensions and disability status;

• driving licence, vehicles, and companies owned or managed;

• financial information: IBAN, tax debts and payment history through MPay.

AGE stresses that not all affected people had all these categories of data exposed. The National Center for Personal Data Protection (CNPDCP), which was notified by AGE, says the list reflects a preliminary assessment. Bank card data was not affected because the government platform does not store it, according to AGE. The Agency also explains that knowing an IBAN does not provide access to an account or enable transfers, and that accessing information about an asset or a company does not mean that ownership has been transferred.

Official timeline

• 19–23 October: the period during which around one million IDNPs were queried (AGE).

• Night of 22 October: the time of the incident, according to the initial AGE–STISC–ASC statement.

• 23 October, 11:30 a.m.: the unauthorised data extraction was stopped. On the same day, 82 public services and more than 30 information systems and administration panels were disconnected as a precaution.

• 24 October: AGE, STISC and ASC publicly announce the incident. The Police and CNPDCP are informed.

• 25 October, around 2:00 a.m.: a new attempt to force access is blocked.

• 27 October: further extraction attempts around 7:00 a.m. are unsuccessful. AGE publishes preliminary figures and a technical explanation, while another 11 services come back online.

• 28 October: Prime Minister Vasile Tofan announces the resignation of AGE Director Nicoleta Colomeeț. Artiom Cociu is appointed acting director. AGE temporarily disables MPass authentication through the “two-step” and EVOSign options. The Presidency announces that the National Security Council will be convened, without specifying a date.

• 29 October: Parliament announces closed-door hearings on 4 November.

• 30 October: the Prosecutor’s Office announces that a criminal investigation has been launched. AGE reports that 61 services have been restored and 21 remain unavailable.

Who is investigating and what is known about the perpetrators

AGE says the scale of the incident is the subject of an audit and investigations conducted by ASC, STISC, the Information and Security Service (SIS) and AGE. The National Center for Personal Data Protection and the Cybercrime Center of the National Investigation Inspectorate have also been notified. The Chișinău Prosecutor’s Office has launched a criminal investigation into violations of privacy and the disclosure of data from the criminal investigation, Violina Moraru, spokesperson for the Prosecutor General’s Office, told MOLDPRES.

The perpetrators have not been officially identified. Prime Minister Tofan said there were indications of a wider campaign and that the competent services were also investigating the possible involvement of foreign state actors, without naming any country. Mihai Lupașcu said that “it is too early to make attributions at this stage”. According to him, 700 distinct IP addresses were involved in the attack.

Questions and answers

Was my data stolen even if I don’t use EVO?

It is possible. AGE explains that the data comes from state registers, not from the app. The Agency says it will provide further information directly to affected people and is working on a mechanism for individual notification, which will be announced publicly. On 30 October, AGE said that lists by data category were still being checked to remove overlaps, and that publishing unvalidated results could lead to inaccurate information.

How do I check in EVO?

AGE recommends the following steps: in the EVO app, go to Account → Data access history, select 2026 and check whether there are entries for “Request for civil status documents” or “Issuance of a driving licence”.

AGE explains that these entries appeared because the initial attacks targeted an electronic service that incorrectly logged the legal basis for processing data. As a result, the access appears in the history as a request for services that people had not requested. However, the history is not a complete list of the data extracted, and AGE has not said that the absence of such an entry means a person was not affected. Since 28 October, according to AGE, it has only been possible to authenticate in the EVO app using a mobile signature, because the “two-step” and EVOSign options in MPass have been temporarily disabled.

Do I need to replace my identity card?

No. AGE says that your IDNP and data remain the same on a new document, so replacing your identity document would not eliminate the risks.

How could my data be used?

AGE warns that attackers may impersonate institutions, companies, banks or people close to you. The risks listed by the Agency are fraud, identity theft, online manipulation, and fraudulent calls or messages. The 24 October statement explains that scammers may use a person’s name and IDNP to gain their trust, but the fact that a caller knows this information does not mean they represent an official institution.

Asked by Europa Liberă about the risk of the data being used to obtain loans, Mihai Lupașcu said that, according to information from ASC, “the risk that this data could be used to take out loans has been ruled out”. However, he noted that he was not mandated to speak on behalf of the National Bank and recommended that the question be addressed to the banking sector.

How can I officially find out what data of mine was targeted?

Until the individual notification mechanism is launched, AGE advises submitting a petition. It can be sent electronically, with an electronic signature, to office@egov.md, or on paper, signed by hand, and submitted at AGE’s offices or sent by post. The petition must include your first name, last name, address, reason for the request, the authority to which it is addressed and what you are requesting.

The CNPDCP recalls that, under Law No. 195/2024 on the Protection of Personal Data, the controller must notify the Centre within 72 hours, where possible, of becoming aware of the incident. When a breach may pose a high risk, the data subjects must be informed without undue delay, and the notification may be made public if informing each person individually would involve a disproportionate effort. Anyone who believes they may have been affected can contact the controller for clarification and to exercise the rights provided for by law, according to the CNPDCP.

What to do now

• Do not give anyone your passwords, codes received by SMS or card details, even if the person you are speaking to tells you your name and personal identification number (IDNP).

• Do not open unsolicited links or confirm payments you did not initiate.

• Check any unusual request by calling the institution or bank yourself, using the numbers listed on their official websites.

• If someone close to you asks for money from a new number or account, call them on the number you know.

• Do not react impulsively to alarming messages about family members. Check first.

• If you notice transactions you do not recognise, call the bank immediately.

• If you use EVO, check the Data Access History for 2026.

• If you suspect fraud or the unauthorised use of data, report it to the police, your bank or the CNPDCP, as appropriate.

What happens next

On 4 November, the parliamentary committee on national security, defence and public order will hold closed-door hearings. According to Parliament Speaker Igor Grosu, they aim to clarify the circumstances and identify the institution responsible. The Government has announced the rapid establishment of a national cybersecurity centre (SOC) within the ASC, the procurement of web application protection solutions and ongoing audits. No date has been announced for the meeting of the National Security Council.

COMUNICA.MD previously published the Presidency’s announcement on the convening of the National Security Council. The graphics in this article are part of a series of responses published by the Electronic Governance Agency and also shared through media channels.