"We have seen coordinated attacks on a large scale. This shouldn’t be seen as an isolated incident. We’re looking at whether there was any foreign state actors involved," he said. The government has not named any countries or hacking groups.
In total, hackers targeted vulnerabilities between October 19 and October 23 to gain large amounts of personal data from government services. They made around 11 million requests to access data.
Preliminary findings show that information relating to around 750,000 identification numbers was removed but this does not necessarily mean all personal data was compromised.
This could include personal information such as full names, date and place of birth, family relations, health insurance, social benefits, pensions, disabilities, drivers licences, images and car ownership. Financial information such as bank account numbers, tax liabilities and government payments could also have been accessed.
However, authorities said there was no breach of bank cards and no evidence of the attackers attempting to tamper with official government documents.
Initially the hackers exploited vulnerabilities within services that did not require authentication. This was then used to access more records from the government services that are linked.
The government have reviewed 82 digital public services and have disconnected the vulnerable services. Over 30 government information systems and administrative services were also disconnected.
Several public services were impacted including applying for building permits, veterinary transport authorisations, importing medicine and food safety registrations.
Most of the services have now been secured, however they are being gradually reconnected following further security checks.
On October 23 the authorities said unauthorised access was stopped. However, they said they identified further attempts on Sunday and Tuesday but these were unsuccessful.
The government has warned that criminals could attempt to use the stolen information for fraud and impersonation. They could try to impersonate someone from a bank or public institution to get people to give them passwords or codes or send them money.
The incident could be part of a larger hybrid attack campaign, government spokesperson Dumitru Ciorici said.
Moldova has been constantly targeted by cyber attacks and disinformation since Russia launched a full invasion of Ukraine in 2022.
Moldovan officials have previously accused Russia of launching disinformation campaigns to destabilise the country and weaken state institutions. They have also undermined confidence in the pro-European government led by President Maia Sandu. The latest incident has raised concerns over the security of Moldova’s digital services.
