The National Security Council of Moldova, convened by President Maia Sandu, reviewed a major cyberattack on government information systems and agreed on steps to strengthen cybersecurity, protect citizens’ data and modernise the state’s digital infrastructure.
The October attack targeted infrastructure managed by the Electronic Governance Agency and affected several digital services. Attackers exploited weaknesses in authentication and access-control systems to reach data in the registers of at least ten public institutions.
The attack began on the evening of 19 October. On 20 October, government systems received about one million automated requests, 30 times the usual average. More than 260,000 records concerning family relationships were extracted that day. Institutions began limiting data extraction on 21 October, and the attacks were blocked by 24 October. Later attempts at unauthorised access were also thwarted.
The latest assessment found that personal data belonging to about 450,000 citizens had been accessed, a lower figure than previously reported. The Electronic Governance Agency will notify affected people. It has fixed issues identified in the MPass authentication service, added further checks on data-access rights and strengthened the security of government platforms.
The council agreed on six priorities: setting up a working group led by the prime minister; modernising state information systems; reforming public IT procurement; establishing rules for systems throughout their life cycle; clarifying institutional responsibilities; and strengthening cybersecurity testing, updates and round-the-clock monitoring. The working group is to propose systemic solutions within a month, with progress to be reviewed at another council meeting in three months.
Sandu said the incident had not affected the integrity of banking data and that an IBAN alone does not provide access to a bank account. However, illegally obtained personal data could be used in scams. Banks will be informed about people whose data was accessed, and citizens were urged not to share passwords, PINs or card details by phone or text message.
Relevant institutions will prepare a lesson for middle- and high-school students on protecting personal data and preventing online fraud. The National Crisis Management Centre and the Cyber Security Agency will produce a practical digital-security guide for the public. Citizens needing immediate assistance were advised to call 112.
Translated from Romanian using artificial intelligence. Source: President of Moldova
