The director of Moldova’s e-Government Agency (AGE) has resigned after a cyberattack in which, according to the agency, attackers extracted personal data linked to about 750,000 state personal identification numbers, known as IDNPs, from government information systems.
The agency’s preliminary findings show that about one million IDNPs were queried between Oct. 19 and Oct. 23 in an attempt to extract personal data without authorization. The extraction was stopped on Oct. 23, when 82 public services and more than 30 information systems and administration panels were disconnected as a precaution. Further attempts to access government services by force were blocked on Oct. 25, and new extraction attempts on Oct. 27 failed.
The extracted data includes names, dates and places of birth, as well as information on first-degree family members, health insurance status, family doctors, social benefits, pensions, disability, driving licenses, photographs and vehicles and companies owned or managed. Financial details include bank account numbers (IBANs), tax debts and payment histories from MPay, the government’s online payment service. Not every affected person had all of these categories exposed, the agency said. Bank card data was not affected, and investigators found no unauthorized changes to state registers.
According to the agency, the attackers exploited vulnerabilities in services that could be accessed without authentication, then used the data they obtained to make further extractions. The first attacks targeted an e-service that logged the legal basis for processing incorrectly, which is why citizens saw requests for civil status documents or driving license processing in the data-access history of the EVO government app.
Nicoleta Colomeeț said she was ending her mandate as AGE director on her own initiative, after agreeing with Prime Minister Vasile Tofan that the agency needs stronger technical leadership. “The cyber incident is serious, and its impact continues to be analyzed,” she said. Artiom Cociu will lead the agency on an interim basis.
Colomeeț said AGE was managing more than 30 systems and 200 services when she took over in November 2024, and that it now operates with 74 people, against 108 approved positions and a recommended team of at least 140.
Tofan has said authorities are investigating indications of a broader campaign involving foreign state actors, without naming any countries. Public services are being restored gradually after remediation and testing, while a wider security assessment of government systems is under way.
Sources: noi.md, RFI, Telegraph.md, TVP World
–
By the ID Tech Editorial Team
