Experts warn of risks after Moldova data breach
Cybersecurity experts say Moldova’s data breach, which exposed information linked to about 750,000 citizens, resulted from systemic weaknesses and inadequate safeguards across interconnected public services.
Overreliance on personal identification numbers
Personal data protection expert Sergiu Bozianu said one of the main problems was the centralisation of public services through a single integration point and the use of the same personal identification number across multiple government databases.
According to Bozianu, suspicious access activity may have started as early as the summer and continued into September, with attackers gradually testing vulnerabilities in government systems.
“The basic mistake was that, instead of masking the IDNP, concealing it, encrypting it and using communication IDs between systems – which could be quickly changed in the event of a compromise – we used the IDNP as the sole or simplest means of interaction between systems,” Bozianu said on Radio Moldova’s Spațiul Public programme.
He identified this approach as the vulnerability exploited by the attackers.
Bozianu also explained why most of the suspicious activity took place at night. Digital services operate around the clock, but large-scale data updates are often scheduled overnight.
“Digital services do not distinguish between night and day. However, the attackers chose nighttime because that is when large-scale data update processes are scheduled,” he said, citing the National Social Insurance House and the National Health Insurance Company as examples.
Risks extend beyond financial fraud
Cybersecurity expert Pavel Horea described the incident as a major vulnerability for the state, with potential implications for national security.
He warned that the extracted information could be used not only for financial fraud but also to build detailed profiles of individual citizens. Such profiles could subsequently be exploited in manipulation campaigns or attempts to influence electoral behaviour.
“Beyond financial fraud and similar issues, there is also the possibility of building a profile of each citizen. Once you have this combination of data, together with information available online and on social media, you can build a detailed picture of an individual, including their preferences, vulnerabilities and risks,” Horea said.
Shared institutional responsibility
Digital policy expert Victor Guzun said responsibility for the incident should not rest solely with the Electronic Governance Agency, but should be assessed across the entire institutional system involved in digitalisation and cybersecurity.
He pointed to Estonia, which experienced major cyberattacks in 2007 and subsequently used the crisis as an opportunity to strengthen its digital security infrastructure.
“Our institutions need to be strengthened and equipped with greater human, financial and technological capacity. The more services we move into the digital environment – and Moldova has made remarkable progress in this area – the greater the risks will become. The Republic of Moldova must have the capacity to respond to these risks. There have been many in the past, and I can assure you there will be more,” Guzun said.
Government information systems in the Republic of Moldova were targeted by cyberattacks between October 19 and 27, involving approximately one million state personal identification numbers (IDNPs).
According to preliminary investigations, personal data associated with approximately 750,000 IDNPs was extracted without authorisation. The information targeted included identification details, records concerning social benefits and pensions, as well as financial information.
Translation by Iurie Tataru
RELATED COVERAGE
- Cyberattack on Moldova's digital services: 11 million requests for citizens' data
- Data leaks could enable manipulation, but not direct account theft, Minister Claudiu Năsui
- Voter data safe: CEC assures State Register of Voters was not compromised after cyberattack
- Over 700 IP addresses were involved in the cyberattack
- Moldova PM seeks to restore trust after cyberattack
