Data of around 450,000 citizens accessed in attack on government systems

Personal data belonging to around 450,000 citizens was accessed in the October 2026 cyberattack on the government systems of the Republic of Moldova, according to the Presidency. The Electronic Governance Agency (AGE) is to notify the affected individuals, and banks will be informed so they can carry out additional checks on any transactions initiated in their names.

What does this mean for you?

People whose data was accessed are to be notified by AGE. Banks will receive information about these individuals so they can carry out additional checks in the event of any transactions initiated in their names.

The President of the Republic of Moldova, Maia Sandu, said that the integrity of bank data had not been affected and that possessing an IBAN code does not, in itself, allow access to accounts. However, she warned that the extracted data could be used for fraudulent calls or messages in which attackers claim to represent banks or public institutions.

Citizens are urged not to share passwords, PIN codes or card details by phone or SMS, and to verify suspicious requests directly with the institutions concerned through official channels. AGE’s contact channels can be used for information about personal data or suspected fraud, while 112 should be called for immediate assistance.

How did the attack unfold?

The attack on infrastructure managed by AGE began on the evening of 19 October 2026 and affected several digital services, according to assessments presented to the National Security Council. The attackers exploited problems with authentication and access control to reach data in the registers of at least 10 public institutions.

On 20 October 2026, around 1,000,000 automated requests were recorded—30 times the usual average—and more than 260,000 records on family relationships were extracted. The institutions began responding on 21 October, and the attacks had been blocked by 24 October; according to the Presidency, subsequent attempts were thwarted.

What problems were identified?

AGE fixed issues identified in MPass, added checks on the right to access data and strengthened the security mechanisms of government platforms, according to the Presidency. The National Security Council agreed on measures to protect data and modernize digital infrastructure.

Maia Sandu also pointed to shortcomings in coordination and communication between institutions. According to the assessment presented by the head of state, the incident was detected late, the institutional response was insufficiently coordinated, and the public information provided did not address all citizens’ concerns.

What information measures are planned?

The responsible institutions, including the Ministry of Education, will prepare a framework lesson for middle- and high-school students on protecting personal data and preventing online fraud. The National Crisis Management Centre and the Cybersecurity Agency will also prepare a practical digital security guide for citizens.