Open by Default: Moldova’s E-Government Answered a Million ID Lookups Without Asking Who Was Calling

Moldova has spent the last few years building a digital state. Citizens deal with government through the EVO portal and app. Institutions exchange data through the MConnect interoperability platform. A new personal-data law aligned with the GDPR took effect on 23 August 2026 (Logos Press, 24 Aug 2026). In July, the country was ranked fifth in the world on the National Cyber Security Index, with Law No. 48/2023 on cybersecurity and a new Cybersecurity Agency cited as the reasons (Logos Press, 3 Jul 2026). About three and a half months later, the same digital state became the channel for what the head of that agency called ‘the largest cyberattack recorded so far’ (RFE/RL, 29 Oct 2026).

The mechanism did not involve a stolen password. Between 19 and 23 October, attackers queried about one million IDNPs through electronic services that could be accessed without authentication. Data from early extractions was used to run further ones (ID Tech, 29 Oct 2026; Cotidianul, 27 Oct 2026). The preliminary investigation found weaknesses in access control and in how authentication credentials were checked. These let the attackers send requests automatically and retrieve other people’s personal data (NewsMaker, 31 Oct 2026). The data reachable this way included family links, health-insurance status, family doctor, pensions, disability status, driving licences, photographs, vehicles, companies, IBANs, tax debts and MPay payment history (Cotidianul, 27 Oct 2026).

The security monitoring did not catch it. A citizen did. On 22 October, someone checking the access history in their EVO account saw requests they had not made and reported them to the Electronic Governance Agency (AGE). Only then did the authorities find the unusual activity, and log analysis later showed it had started days earlier (NewsMaker, 31 Oct 2026). On 23 October, AGE stopped the extraction and disconnected 82 public services and more than 30 information systems and administration panels (Cotidianul, 27 Oct 2026). On 28 October, AGE director Nicoleta Colomeeț resigned. She noted that the agency had 74 staff against 108 approved posts and a recommended minimum of 140 (ID Tech, 29 Oct 2026).

This is the double edge of digitalisation. Every service that makes the state easier to reach also makes its data easier to reach, at the same speed, for anyone who asks. Prime Minister Vasile Tofan has cited ‘indications of a broader campaign involving foreign state actors’, and the head of the Cybersecurity Agency believes AI was used to find the vulnerabilities, though neither claim has been substantiated in public (RFE/RL, 29 Oct 2026). The lesson does not depend on who did it. Any organisation that puts data behind a public web service without strong authentication, per-record authorisation and rate limits has built the same export channel.

1. What Happened

1. Between 19 and 23 October 2026, attackers queried about one million IDNPs against government e-services. According to Moldova’s IT and Cyber Security Service (STISC), they allegedly accessed personal information associated with about 750,000 of them (Cotidianul, 27 Oct 2026).
2. On 22 October, a citizen saw suspicious access to their data in the EVO access history and reported it to AGE. The same day, authorities identified unusual activity in government digital services (NewsMaker, 31 Oct 2026).
3. Unauthorised extraction was stopped at 11:30 on 23 October. AGE preventively suspended 82 public services and more than 30 information systems and administration panels (Cotidianul, 27 Oct 2026).
4. Affected services included the National Archives Agency’s electronic service and the Public Services Agency’s service for booking driving-test appointments (NewsMaker, 31 Oct 2026).
5. According to the authorities, the attackers exploited vulnerabilities in e-services that could be accessed without authentication. One government service recorded the legal basis for data processing incorrectly, which is why citizens saw requests in EVO they had never made (Cotidianul, 27 Oct 2026).
6. Further attempts to force access were detected and blocked at about 02:00 on 25 October and about 07:00 on 27 October (Cotidianul, 27 Oct 2026).
7. AGE informed the National Bank of Moldova on 26 October. On 27 October, it notified public authorities that exchange data via MConnect and asked them to review suspicious access (NewsMaker, 31 Oct 2026).
8. AGE director Nicoleta Colomeeț resigned on 28 October, and Artiom Cociu became interim head (ID Tech, 29 Oct 2026; TV8, 30 Oct 2026).
9. On 29 October, President Maia Sandu’s office said the National Security Council would meet to assess the attack (RFE/RL, 29 Oct 2026). The Chișinău Municipal Prosecutor’s Office is investigating in a criminal case (TV8, 30 Oct 2026).
10. As of 30 October, 61 services had been restored and 21 remained unavailable. AGE said it was preparing a mechanism to notify each affected person individually (TV8, 30 Oct 2026).

2. Business Impact

[CONFIRMED] Mass exposure of personal data. Information associated with about 750,000 IDNPs was exposed, out of about one million queried (STISC, via Cotidianul, 27 Oct 2026). The authorities stress that not every person was exposed in every category and that ‘the exact extent of the data accessed is to be determined during the investigation’ (Cotidianul, 27 Oct 2026).

[CONFIRMED] Special-category and financial data are in scope. The categories include disability status, health-insurance status and family doctor, alongside IBANs, tax obligations and MPay payment history (Cotidianul, 27 Oct 2026). The authorities say bank card data was not compromised and that no unauthorised changes to state registers have been found (RFE/RL, 29 Oct 2026).

[CONFIRMED] Loss of digital public services. 82 services and more than 30 systems and administration panels were taken offline on 23 October (Cotidianul, 27 Oct 2026). A week later, 21 services were still unavailable (TV8, 30 Oct 2026). The cost of the outage to citizens and businesses has not been quantified: scale not publicly disclosed.

[CONFIRMED] Leadership and accountability consequences. The head of the e-government agency resigned (ID Tech, 29 Oct 2026). A criminal case is open (TV8, 30 Oct 2026), and the National Security Council has been convened (RFE/RL, 29 Oct 2026).

[ESTIMATED] Downstream fraud exposure. The authorities warn that the stolen data could be used in scam attempts (TV8, 30 Oct 2026). Data that combines names, family links, benefits and bank-account identifiers suits targeted social engineering. No fraud losses have been reported; this is an assessed risk, not a measured one.

[ESTIMATED] Erosion of trust in e-government. Citizens posted screenshots of unexplained requests in their EVO accounts, and some said they plan to sue the state (Moldova Live, 27 Oct 2026). These are reported social-media reactions, not a measured change in service use.

3. Likely Root Cause

Data-returning e-services were reachable without authentication, so knowing a person’s IDNP was enough to retrieve information about them.

Source: STISC/AGE, via Cotidianul, 27 Oct 2026; ID Tech, 29 Oct 2026.

Access control and credential verification were weak in certain systems, which allowed automated requests for other people’s data. This is the classic broken object-level authorisation pattern: the service checked that a request was well-formed, not that the requester was entitled to that record.

Source: preliminary investigation, via NewsMaker, 31 Oct 2026. The BOLA classification is SEG’s assessment; AGE has declined to publish technical details, citing the ongoing investigation.

No effective throttling or enumeration detection. About one million IDNPs were queried over five days, and output from early queries was used to run further ones.

Source: ID Tech, 29 Oct 2026 (volume and chaining). Assessed: the scale is inconsistent with working per-client limits. MOLDPRES reports at least 700 IP addresses were involved (c. 31 Oct 2026), which would defeat per-IP limits alone.

Audit logging did not support detection. One service recorded an incorrect legal basis for processing, and the first alert came from a citizen reading their own access history rather than from the SOC.

Source: Cotidianul, 27 Oct 2026; NewsMaker, 31 Oct 2026.

Security capacity did not grow with the digital estate. The agency had 74 staff against 108 approved posts and a recommended minimum of 140.

Source: outgoing AGE director, via ID Tech, 29 Oct 2026. Assessed as a contributing factor, not a proven cause.

[UNRESOLVED] The initial entry point and the tooling. Risky Bulletin reports the entry was an internet-exposed logging service without authentication. The Cybersecurity Agency head believes AI was used to find the vulnerabilities.

Single-source (Risky Bulletin, 28 Oct 2026) and official opinion without published evidence (RFE/RL, 29 Oct 2026). Unconfirmed by AGE.

4. Control Failures

[CF-1] 🪪 IDENTITY Public e-services returned personal data keyed on an IDNP without authenticating the caller or verifying that the caller was entitled to that person’s record (no object-level authorisation).

[CF-2] ⚙️ TECHNOLOGY No effective rate limiting, bot controls or enumeration detection. About one million distinct identifiers were queried over five days, apparently from hundreds of IP addresses, before anyone intervened.

[CF-3] 📋 PROCESS Monitoring and audit-trail integrity failed. Access logs existed but nobody watched them, one service logged the wrong legal basis, and detection came from a citizen three days after the attack began.

[CF-4] 📋 PROCESS Over-broad data aggregation through interoperability. Front-end services could pull fields from many registries (health, pensions, tax, vehicles) through MConnect, far beyond what a task like booking a driving test needs.

[CF-5] 👥 PEOPLE The human side did not keep pace with digitalisation. The security team was staffed well below its recommended level, and affected citizens and staff had no ready channel or guidance for the targeted fraud that follows a breach like this.

5. Recommendations

5A — Organisational & Technical Controls

Audience: security and IT teams.

CF-1 — Put every personal-data endpoint behind authentication plus object-level authorisation (OWASP API Security Top 10 2023 — API1 Broken Object Level Authorization, API2 Broken Authentication; OWASP ASVS 4.0.3 V4.2.1 — IDOR protection)

Make the API gateway deny anonymous requests by default and route through an OIDC identity provider backed by the national eID or an equivalent with MFA. Validate the token’s audience and expiry on every call. Server-side, derive the subject identifier from the token, never from a URL or form parameter. Compare it to the record requested and allow access only if they match or if a delegation (parent, guardian, authorised representative) is verified in a separate entitlement store. Inventory every internet-facing endpoint from gateway logs and DNS, not from documentation. Any endpoint that returns personal data without a session token is a stop-ship finding.

CF-2 — Rate-limit by identity, not just by IP, and alert on enumeration (OWASP API Security Top 10 2023 — API4 Unrestricted Resource Consumption, API6 Unrestricted Access to Sensitive Business Flows; ISO/IEC 27001:2022 Annex A 8.16 — monitoring activities)

A citizen looks up their own record, not thousands of others. Enforce quotas per authenticated subject and per client credential, and set the thresholds from your observed baseline. Do not rely on per-IP limits, because a distributed attack spread across hundreds of addresses walks straight past them. Add bot-management challenges to any form that remains pre-login, such as appointment booking. Write a SIEM rule that alerts when one session, client ID, ASN or user-agent cluster touches an unusual number of distinct national identifiers in an hour. Return masked values (initials, last four digits) unless the caller is the record owner.

CF-3 — Make the access log a detection sensor and the citizen’s access history a reporting channel (ISO/IEC 27001:2022 Annex A 8.15 — logging; NIS2 Art. 21(2)(b) — incident handling)

Log every record access with requester identity, calling service, record subject and legal-basis code. Validate the legal-basis code against an allow-list for each service, so a service that is not entitled to a basis is rejected at write time, not just recorded wrongly. Stream the logs to the SIEM in near-real time, with 24/7 alerting owned by a named team. Add a one-tap ‘I did not request this’ button to the citizen access-history view. Feed it straight into the SOC queue with a same-day triage target, so the next citizen report becomes an alert within minutes, not a social-media post.

CF-4 — Scope interoperability to the field, per consuming service (GDPR Art. 25(2) — data protection by default; ISO/IEC 27001:2022 Annex A 8.3 — information access restriction)

On the data-exchange platform, give each consuming service a signed scope listing the exact registries and fields it may request. A driving-test booking service needs a name and licence status, not IBANs, disability status or family links. Enforce the scope at the exchange layer, not in the front-end code. Require a DPIA (GDPR Art. 35) before any new scope is granted. Recertify every service’s scopes quarterly with the owning institution. Pre-agree and rehearse a kill switch that can suspend a single consuming service’s scope without taking the whole portal down.

CF-5 — Tie digital roll-out to security capacity through a launch gate owned by the management body (NIS2 Art. 20(1) — management approval and oversight of risk-management measures; Art. 21(2)(e) — security in development and maintenance)

No new public e-service goes live without four things: a threat model, an authorisation-focused penetration test that covers object-level access and enumeration, documented rate limits, and a named service security owner. Report the ratio of internet-facing services to security staff to leadership every quarter, and do not approve new services while that ratio is outside an agreed band. Keep the 23 October response pattern as a written runbook: precautionary disconnection of entire service groups, restoration only after security re-verification. Deliver the user-facing rules below (5B) through official channels before the individual breach notifications go out.

5B — For Everyone Whose Data Lives in a Government or Company Portal

↳ CF-5 GDPR Art. 34(2) — communication to affected people in clear and plain language; NIS2 Art. 21(2)(g) — basic cyber hygiene and cybersecurity training

1. Check who has looked at your data.

If your portal or app has an access history, open it once a month. In this case, a citizen who did exactly that raised the alarm. If you see a request you did not make, report it through the official channel straight away.

2. Be suspicious of any caller who already knows a lot about you.

Stolen data like this includes family members, benefits and bank-account numbers. A scammer can sound official because they really do know your details. Hang up and call back on a number you found yourself.

3. Never share a password or a one-time code, with anyone.

No government office, bank or employer will ask you for them by phone, text or email. A request for a code is the scam, whatever reason they give.

4. An account number alone cannot empty your account, but it can make a lie convincing.

The authorities confirm that knowing your IBAN does not allow withdrawals. Expect it to be used as ‘proof’ in a fake call or invoice, so verify before you pay or confirm anything.

5. Wait for the official notice and do not click lookalikes.

If you were affected, the authority will tell you through its official channels. Fake ‘breach notifications’ with links or attachments usually follow real breaches, so go to the official website by typing the address yourself.

SEG Security Awareness Training · free to forward inside your organisation

6. Regulatory Relevance

GDPR — Regulation (EU) 2016/679 (and Moldova’s Law No. 195/2024, which transposes it)

Art. 25(1)–(2) data protection by design and by default; Art. 32(1)(b) and (d) confidentiality and regular testing; Art. 9(1) special categories (health data: disability, health insurance, family doctor); Art. 33 notification to the authority within 72 h; Art. 34 communication to data subjects

Moldova is not in the EU, but its new data-protection framework, Law No. 195/2024 with the National Center for Personal Data Protection (CNPDCP) as supervisor, implements the GDPR and took effect on 23 August 2026 (Logos Press, 24 Aug 2026). An EU controller running this architecture would face an Art. 25 design failure and an Art. 32 security failure at once, with Art. 9 aggravating the case because health-related data was exposed. AGE’s planned individual notifications match Art. 34. The corresponding article numbers in Law 195/2024 are [UNRESOLVED]: this edition did not retrieve the law’s text. [KB UPDATE NEEDED] Moldova Law No. 195/2024 — Framework Law on the Protection of Personal Data (Republic of Moldova); GDPR-aligned, supervised by CNPDCP, in force 23 Aug 2026; relevant to any Moldovan controller or processor and to EU firms operating there.

NIS2 — Directive (EU) 2022/2555 (and Moldova’s Law No. 48/2023 on cybersecurity)

Annex I — public administration entities; Art. 20(1)–(2) management-body approval, oversight and training; Art. 21(2)(b) incident handling, (e) security in acquisition, development and maintenance, (i) access control, (j) MFA; Art. 23 (24 h early warning / 72 h notification)

For EU member-state readers, a central-government e-service platform falls in NIS2’s public-administration sector. Every control failure here maps onto Art. 21(2): (i)/(j) for CF-1, (e) for CF-1/CF-4, (b) for CF-3. Art. 20 puts the capacity question (CF-5) squarely on the management body. Moldova’s Law No. 48/2023 was credited with aligning the national framework with European standards (Logos Press, 3 Jul 2026). Its specific article numbering and reporting clock are [UNRESOLVED] here. Intersection: GDPR Art. 25 and NIS2 Art. 21(2)(i) are breached by the same missing control, an unauthenticated data endpoint, so the 72 h GDPR notification and the NIS2 24 h/72 h reports would run in parallel for an EU entity. [KB UPDATE NEEDED] Moldova Law No. 48/2023 — Law on Cybersecurity (Republic of Moldova); NIS-aligned framework establishing the Cybersecurity Agency (ASC); relevant to Moldovan public bodies and essential-service operators and to EU-accession alignment.

OWASP API Security Top 10 (2023)

API1:2023 Broken Object Level Authorization; API2:2023 Broken Authentication; API4:2023 Unrestricted Resource Consumption; API6:2023 Unrestricted Access to Sensitive Business Flows

This is the most precise technical taxonomy for the case. API1 and API2 describe the access failure (CF-1), and API4 and API6 the bulk-extraction failure (CF-2). Use it as the acceptance criterion for the authorisation-focused penetration test in CF-5. [KB UPDATE NEEDED] OWASP API Security Top 10 (2023) — OWASP’s API-specific risk list; complements the web Top 10 and ASVS already in §8.5; relevant to any case involving data exposed through APIs or e-services.

ISO/IEC 27001:2022

Annex A 5.34 (privacy and protection of PII), 8.3 (information access restriction), 8.5 (secure authentication), 8.15 (logging), 8.16 (monitoring activities), 8.26 (application security requirements), 8.29 (security testing in development and acceptance)

A certified ISMS covering a public data service would struggle to show A 8.26 and A 8.29 were effective when endpoints went live without authentication, or that A 8.16 operated when a citizen detected the breach before the SOC did.

CIS Controls v8.1

Safeguards 3.3 (configure data access control lists, IG1), 6.3 (require MFA for externally exposed applications, IG2), 8.11 (conduct audit log reviews, IG2), 13.1 (centralise security event alerting, IG2), 16.10 (apply secure design principles in application architectures, IG2)

3.3 is an IG1 safeguard, the baseline expected of every organisation. An access-control failure at that level is a question of ownership and resourcing, not technical sophistication, which ties back to CF-5.

7. How SEG Can Help

CF-1 / CF-2 — 💡 Penetration Testing

SEG tests public APIs and e-services the way this attacker did. We call endpoints with no token, swap identifiers between sessions to test object-level authorisation, and run distributed enumeration from rotating IP ranges to show whether rate limits and alerts actually trigger.

CF-1 — 💡 Vulnerability Management

SEG builds a live inventory of every internet-facing endpoint from DNS, certificates and gateway logs. We flag any endpoint that returns personal data without authentication and track it as a critical finding with a remediation deadline.

CF-4 — 💡 SaaS Configuration Review

SEG reviews the configuration of API gateways, identity providers and data-exchange platforms: token validation, field-level scopes per consuming service, default-deny routing and logging coverage. Each finding is mapped to GDPR Art. 25(2).

CF-3 / CF-5 — 💡 vCISO

SEG’s vCISO sets up the service launch gate, the capacity-to-services ratio reported to leadership under NIS2 Art. 20, the detection SLAs, and the precautionary-shutdown runbook. Digitalisation then goes ahead with security planned in, not bolted on afterwards.

CF-5 — 💡 Security Awareness Training

SEG turns the 5B rules into a short module for staff and a ready-to-send notice for customers or citizens. We follow it with a post-breach phishing simulation that uses ‘we already know your details’ lures, and measure how many people report it.

CF-4 — 💡 Third-Party Risk Assessment

Where e-services or integrations are built or run by contractors, SEG assesses the supplier’s secure-development and authorisation-testing practices. We also write launch-gate evidence (threat model, pentest report, rate-limit design) into the contract as a delivery requirement.

🎯 Strategic Signal

Interoperability is turning national registers into one queryable surface. That is the point of e-government, and also its new single point of mass extraction. Expect attackers, possibly helped by AI-driven discovery, to probe the thinnest public front end of a digital state rather than the registers behind it. The organisations that come out well will treat every new digital service as an attack surface to be gated, scoped and watched from day one, not as a convenience to be secured later.

💬 SEG Expert View — Dmytro Yershov, CISO

“Progress is a double-edged sword, and Moldova has just shown both edges. The country built a digital state that citizens actually use and earned international recognition for its cybersecurity framework. Then a set of public services answered requests without asking who was asking. We do not read that as a failure of ambition. It is what happens when the speed of delivery is measured and the security of delivery is assumed. When we advise boards on digital transformation, we ask them to plan for the worst on day one, not after the incident. Every new service that touches personal data needs three answers before launch: who is allowed to call it, how much one caller can take, and who is watching. And if security headcount stays flat while the number of services keeps growing, leadership has already accepted a risk it has not written down. NIS2 makes that decision a management-body responsibility. The good news is that the people involved did the right thing: a citizen noticed, and the agency pulled 82 services offline without hesitating. Build for that moment in advance and it becomes a controlled response, not a crisis.”

— Dmytro Yershov, CISO, SEG (Security Expert Group)

📖 Sources

• RFE/RL — Moldovan President Calls Security Meeting After Massive Data Breach — October 29, 2026
• Cotidianul — Large-scale cyberattack in the Republic of Moldova: personal data associated with about 750,000 IDNPs targeted — October 27, 2026
• NewsMaker — Un cetățean a scos la iveală atacul cibernetic (A citizen exposed the cyberattack: new details) — October 31, 2026
• ID Tech — Moldova E-Government Chief Resigns After Hack Exposed Data Tied to 750,000 ID Numbers — October 29, 2026
• TV8 — Noi tentative de atac cibernetic în Moldova: se pregătesc notificări pentru fiecare persoană afectată — October 30, 2026
• Risky Bulletin — Moldova takes down 80+ public services after cyberattack — October 28, 2026
• Logos Press — How Moldova managed to rank fifth in the world in cybersecurity (NCSI) — July 3, 2026
• Logos Press — New personal data protection rules have taken effect (Law No. 195/2024) — August 24, 2026