---
title: "Mihai Lupașcu on Moldova 1 TV: “Unprecedented” cyberattack involving at least 700 IP addresses"
url: https://radiomoldova.md/p/88438/mihai-lupascu-on-moldova-1-tv--unprecedented-cyberattack-involving-at-least-700-ip-addresses
published: 2026-10-29T09:24:19Z
language: en
author: "Violeta Viliant"
section: "Social"
source: radiomoldova.md
---

# Mihai Lupașcu on Moldova 1 TV: “Unprecedented” cyberattack involving at least 700 IP addresses

> The massive cyberattack on state systems was made possible by exploiting vulnerabilities that allowed unauthorized access to data. Mihai Lupașcu, Director of the Cybersecurity Agency (ASC), states that the scale of the incident points to the involvement of highly skilled attackers, with at least 700 IP addresses already identified as being involved.

![](https://storage.radiomoldova.md/images/a263d28a-76f8-45bf-afae-bb93f857ff00.jpg)

The massive cyberattack on state systems was made possible by exploiting vulnerabilities that allowed unauthorized access to data. Mihai Lupașcu, Director of the Cybersecurity Agency (ASC), states that the scale of the incident points to the involvement of highly skilled attackers, with at least 700 IP addresses already identified as being involved.

The incident affected the E-Governance Agency (AGE) information systems, and authorities are continuing their investigation to determine how the attack occurred and the extent of the data compromise.

*"We are facing an unprecedented situation—it must be said—because as soon as the vulnerability was detected and confirmed, the decision was made to shut down certain services deemed vulnerable. We did this to repair them, verify them, and ensure these services could no longer be exploited to 'exfiltrate' additional data. In terms of incident response, our colleagues did everything within their power,"* stated Mihai Lupașcu during the program "În Context" on Moldova 1 TV.

**At least 700 IP addresses identified**

The investigation has identified at least 700 distinct IP addresses involved in the attack so far. However, because these addresses span multiple locations, it is difficult to determine the operation's origin or identify those coordinating it.

*"At this stage, at least 700 distinct IP addresses involved in this cyberattack have been identified. However, because these addresses span many locations, we do not yet have enough indicators to attribute the attack to a specific group. I can only say that, given the complexity of the attack and the level of sophistication required, we are likely dealing with actors or groups that are highly skilled in this field,"* noted Mihai Lupașcu. The head of the ASC further stated that the attackers exploited vulnerabilities that allowed access to information without authentication, with the operation aimed at the "exfiltration of personal data from systems and certain state registries."

"The investigation is still ongoing. Vulnerabilities existing within certain government platforms were exploited, allowing data to be accessed without authentication," explained Mihai Lupașcu.

**Artificial intelligence used to identify vulnerabilities**

Another challenge is the gap between the technologies currently in use and those upon which some public platforms were originally developed.

"Some digital services and state platforms were developed five or even ten years ago. However, technology that has emerged recently—within the last two years, a period marked by rapid evolution in artificial intelligence—now enables capabilities that were not possible back then. (...) For these reasons, we are in discussions with international partners to gain access to such models. This will allow us to integrate available cybersecurity capabilities into both existing and new platforms, as well as to assess Moldova’s entire digital ecosystem," the ASC director stated on the public television channel.

In this context, the authorities have announced that they are seeking support from external partners—including Estonia—to strengthen cybersecurity capabilities and evaluate the state's digital infrastructure. "Unfortunately, we must recognize that we are facing a trend where cyberattacks are on the rise; as a state, we need to strengthen our detection and protection capabilities for these critical systems," said the head of the Cybersecurity Agency.

**Data of approximately 750,000 individuals compromised**

Given the volume of affected data, the incident is significant; however, the specific categories of information exposed vary from person to person. The data indicates the compromised information may include personal identification details, family-related data, pension and disability information, driver's licenses, vehicle records, company details, and certain financial data.

"This is a serious incident, both in terms of the nature of the event and the large number of personal identification numbers (IDNPs) that have been compromised. (...) At this stage, we know that different types of data were accessed for different categories of individuals. The relevant institutions have disclosed all data fields or sets that may have been compromised," stated Mihai Lupașcu.

According to information gathered during the investigation, the attackers did not target a specific profile of individuals but instead extracted a large volume of data. The E-Governance Agency (AGE) will provide a mechanism that allows citizens to verify which of their personal data was accessed. *“Based on the information we have gathered during the investigation, no specific profiles of individuals targeted by the attack have been identified. The data was extracted indiscriminately, in the largest possible volume. The figure cited is 750,000 affected personal identification numbers (IDNPs). There is no specific profile that the attackers were targeting. (...) The AGE [Electronic Governance Agency] has already announced that it intends to provide a mechanism—or otherwise notify citizens—regarding exactly which data was accessed,”* stated the head of the ASC.

**The primary risk: scams and identity theft**

Compromised personal data cannot be changed as easily as passwords, and people can cross-reference it with other publicly available data. For this reason, authorities advise citizens to remain vigilant—especially regarding calls or messages from unknown individuals claiming to represent public institutions or banks.

*"The primary risk arising from these compromises is, first and foremost, the manipulation of individuals. Someone might pose as a public authority or a bank—I am referring here to the wave of scams that has been occurring since the beginning of the year. (...) Our recommendation is to remain vigilant, just as we have been until now,"* noted the ASC director.

Lupașcu also highlighted the growing difficulty of maintaining anonymity in the digital environment, particularly when compromised data can be linked to other publicly accessible information: *"It has become increasingly difficult to maintain our anonymity in the digital world. The serious issue is that this data can be cross-referenced with other information that is already publicly available."*

**Authorities are preparing additional measures**

The institutions involved are working to identify vulnerabilities and strengthen mechanisms for the prevention and early detection of attacks.

According to the ASC director, the investigation's findings will for the basis for recommendations to improve the cybersecurity of public systems. 

"Everyone is mobilized now; all institutions are working to learn from these lessons. We have previously discussed developing capabilities to prevent and identify cyberattacks, with the aim of achieving more proactive detection and preventing such situations. Once the investigation is complete, we will present conclusions and recommendations which, we believe, will lead to an improved cybersecurity posture and prevent the exploitation of the vulnerabilities targeted in this attack," concluded Mihai Lupașcu.

[Video](https://www.youtube.com/embed/OayxUcTxxqk)

***

Following an attack on government systems between October 19 and 23, the personal data of approximately 750,000 citizens was exfiltrated without authorization. Preliminary investigations indicate that the stolen information includes names, identification numbers, family details, pension records, driver’s license information, and certain financial data.

Certain technical safeguards were not implemented in time to prevent the incident. The attackers exploited vulnerabilities in the IT systems—leveraging artificial intelligence in the process—and, according to authorities, the incident may be part of a broader campaign involving foreign state actors.

The data exfiltration was halted on October 23 at 11:30 AM, though attempts at unauthorized access continued in the days that followed. The E-Governance Agency ordered an audit of 82 digital services and temporarily suspended vulnerable applications. Authorities have provided assurances that no unauthorized alterations were made to state registries and that bank card data remains unaffected.

During a government meeting on October 28, Prime Minister Vasile Tofan announced that the Director of the E-Governance Agency, Nicoleta Colomeeț, is stepping down from her position in the wake of the cyberattacks targeting state digital services.

Authorities also announced plans to overhaul the management and protection of public digital services. Planned measures include improved coordination among responsible institutions, the establishment of a national cybersecurity center, and the implementation of additional protective solutions. The situation will be analyzed during a meeting of the Supreme Security Council, convened by President Maia Sandu.