Tofan urges joint action to secure Moldova's digital services
Prime Minister Vasile Tofan urged Moldova’s digital agencies to work together on restoring public trust on Friday, after a cyberattack exposed data linked to about 750,000 personal identification numbers.
Tofan calls for institutional cooperation
Tofan made the appeal during a visit to the E-Governance Agency (AGE), where former director Nicoleta Colomeeț handed over leadership to Artiom Cociu, who will serve as acting director. The meeting brought together representatives of the Information Technology and Cybersecurity Service, the Cybersecurity Agency and the Public Services Agency.
The prime minister said the cyberattack had damaged public confidence in the state's digital capabilities and called on institutions to focus on practical solutions rather than assigning blame.
“Trust takes a long time to build, but it can be lost very quickly. I believe we have lost a great deal of trust in recent days. I did not come here to point fingers or determine who is to blame. I came here, first and foremost, to focus on solutions,” Tofan said.
He thanked Colomeeț for her work but said a change in leadership was necessary under the circumstances.
“I believe it is also a leader's responsibility to say: I acknowledge that difficult things have happened, that they have affected trust, and that I am ready for us to move forward together with another leader for this organisation. That, too, is leadership,” Tofan said.
New security measures planned
Tofan urged AGE employees to support Cociu and avoid internal tensions that could undermine the institution's response to the crisis.
“The last thing we need right now is internal sabotage or tensions. We do not need that. I ask you to be a responsible team and work together to rebuild trust in the state and its digital capabilities,” he said.
The government is preparing several measures to strengthen the security of public digital infrastructure. These include deploying Cloudflare protection services, developing a Security Operations Centre (SOC), introducing Web Application Firewall (WAF) technology, working with Estonian experts and conducting an inventory of existing systems.
“Whether it is Cloudflare, a WAF, a SOC, help from the Estonians, access to Fable, or an inventory of everything, we are already working on it,” Tofan said.
750,000 identification numbers linked to compromised data
The cyberattack targeted Moldova's government information systems between October 19 and 23. Preliminary investigations indicate that attackers extracted personal data associated with approximately 750,000 state personal identification numbers (IDNPs).
The compromised information may include names, identification numbers, family-related details, pension records, driving licence information and certain financial data. The unauthorised extraction was halted on October 23 at 11:30 a.m., although further attempts to access government systems were detected afterwards.
Following the incident, AGE ordered security checks on 82 digital public services and temporarily suspended vulnerable services. As of October 30, 61 services had been restored, while 21 remained temporarily unavailable pending further security checks.
Authorities said the investigation had found no unauthorised alterations to state registry records. They also confirmed that bank card data had not been compromised and that knowledge of an IBAN alone does not allow access to a bank account or unauthorised transfers.
Criminal investigation launched
The Chisinau Municipal Prosecutor's Office launched a criminal investigation on October 30 into the incident. The case concerns suspected offences involving violations of privacy and the disclosure of information from a criminal investigation.
Authorities are continuing to investigate the source and full extent of the cyberattack, with AGE, the Cybersecurity Agency, the Information Technology and Cybersecurity Service, the Intelligence and Security Service and other competent institutions involved.
The government announced the leadership change at AGE on October 28, when Tofan said the agency's priority should shift towards securing digital public services rather than focusing primarily on promoting their use.
Translation by Iurie Tataru
RELATED COVERAGE
- Voter data safe: CEC assures State Register of Voters was not compromised after cyberattack
- Over 700 IP addresses were involved in the cyberattack
- Cyberattack on Moldova's digital services: 11 million requests for citizens' data
- Data leaks could enable manipulation, but not direct account theft, Minister Claudiu Năsui
- Maia Sandu convenes National Security Council after major cyberattack on Moldova
