CEC suspends EVO digital ID checks ahead of Moldova vote
Voters in Moldova must present physical identity documents at polling stations on November 1, after the Central Electoral Commission suspended digital identification through the EVO app following cyberattacks on government systems.
Physical identity documents required at polling stations
The Central Electoral Commission (CEC) has suspended the use of digital identity cards and identity documents generated through the government's EVO digital wallet for Sunday's local elections and referendum.
The decision follows cybersecurity incidents targeting Moldova's digital public services. The commission said the measure was intended to prevent potential risks while authorities assess the security of the affected systems.
“The CEC remains in dialogue with the Electronic Governance Agency on using digital identification mechanisms for voters in future elections, once all security checks have been completed and the safety of the services concerned has been confirmed,” the commission said in a statement.
EVO is Moldova's government application for accessing digital identity documents and public services, including digital versions of identity cards.
Six localities to hold elections on November 1
Early local elections will take place in six localities: the villages of Cairaclia and Novosiolovca in Taraclia district, the town of Costești in Rîșcani district, Hăsnășenii Mari in Drochia district, and the villages of Tomai and Chirsova in the Autonomous Territorial Unit of Gagauzia.
Mayors will be elected in five localities, while voters in Tomai will elect a new local council.
A local referendum will also be held in Delacău village, Anenii Noi district.
Cyberattack exposed data linked to 750,000 identification numbers
The decision to suspend digital voter identification comes amid an investigation into a cyberattack on government information systems between October 19 and 23.
Preliminary findings indicate that personal data linked to approximately 750,000 State Identification Numbers (IDNPs) was extracted without authorization. The compromised information may include names, identification numbers, family-related details, pension records, driver's licence information and certain financial data.
The unauthorized data extraction was stopped on October 23 at 11:30 a.m., although further attempts to access government systems were detected in the following days.
Following the incident, the Electronic Governance Agency ordered security checks of 82 digital public services and temporarily suspended vulnerable systems.
As of October 30, 61 services had been restored, while another 21 remained temporarily unavailable pending further security checks.
Authorities have found no unauthorized alterations to state registers and said bank card data was not compromised. They have also clarified that knowing someone's IBAN alone does not allow unauthorized access to a bank account or the transfer of funds.
Criminal investigation launched as agency changes leadership
The Chisinau Municipal Prosecutor's Office opened a criminal investigation on October 30 into the incident, citing reasonable suspicion of offences involving violations of privacy and the disclosure of information from a criminal investigation.
Several institutions are investigating the attack, including the Electronic Governance Agency, the Cybersecurity Agency, the Information Technology and Cyber Security Service and the Intelligence and Security Service.
On October 28, Prime Minister Vasile Tofan announced that Nicoleta Colomeeț was leaving her position as head of the Electronic Governance Agency. The decision was agreed by both parties, and Artiom Cociu was appointed acting head of the institution.
The prime minister said the agency's immediate priority should be securing digital public services rather than focusing primarily on promoting their use.
Translation by Iurie Tataru
RELATED COVERAGE
- Voters can use EVO digital IDs at Moldova’s November elections
- Voter data safe: CEC assures State Register of Voters was not compromised after cyberattack
- Over 700 IP addresses were involved in the cyberattack
- Chisinau prosecutors open probe into 750,000-person data breach
- Moldova cyberattack leaves 21 public services offline
