- Moldova’s authorities cannot agree on how many people were affected by a major cyberattack. President Maia Sandu puts the figure at 450,000, although the initial estimate was 750,000. Investigators are looking into links to six countries and have not ruled out internal sabotage. No one has been identified as responsible.
- Parliament Questions the Official Figures
- Six Countries, Two Audits — and Still No Suspects
Moldova’s authorities cannot agree on how many people were affected by a major cyberattack. President Maia Sandu puts the figure at 450,000, although the initial estimate was 750,000. Investigators are looking into links to six countries and have not ruled out internal sabotage. No one has been identified as responsible.
The attack on government IT systems began on 19 October and lasted until the 23rd. Over those four days, the systems logged more than six million requests. At one point, traffic surged to around 30 times its usual level. The attackers stole personal data belonging to hundreds of thousands of people, including their bank account numbers (IBANs), according to the authorities.
After a meeting of the Security Council, Sandu disclosed that databases at no fewer than 10 institutions had been compromised. The automatic intrusion alert system never sounded: the unusually heavy traffic had not been flagged as a threat.
“The authorities’ response was not sufficiently coordinated,” Sandu admitted.
She also rejected reports of possible sabotage, saying there was no evidence to support them. An emergency meeting of the National Security Council resulted in the creation of a cybersecurity task force led by Prime Minister Vasile Tofan. The group has one month to come up with systemic solutions and three months to report back on the progress made.
“Within one month, this group must propose systemic solutions to the problems facing the Republic of Moldova in the field of cybersecurity. In three months, we will return to this issue at a meeting of the National Security Council and assess the progress made,” Sandu said.
The meeting also covered some immediate response measures. Sandu refused to disclose the details, however, arguing that doing so could help the attackers. She did concede that the Electronic Governance Agency (AGE) should have warned the public much sooner.
“I believe AGE should have sent that letter as quickly as possible. I understand that everyone was busy stopping the attack and fixing the vulnerabilities, but far too much time has passed,” she said.
The affected citizens are expected to receive notification letters in the coming days. Banks will be asked to monitor transactions more closely. Strengthening the country’s cyber defences will also require extra public funding, with the government expected to determine the amount within 30 days.
Parliament Questions the Official Figures
At a closed-door parliamentary hearing, MP Haik Vartanian challenged the initial estimate of 750,000 victims, saying the actual number was considerably lower. An exact figure will only be available after an audit, he said.
Vartanian described two compromised datasets. One contained information showing whether individuals were entitled to certain rights or benefits. The other held almost all the personal information available about citizens.
“Unfortunately, these hearings have once again exposed the same problems: irresponsibility, negligence, an unwillingness to take responsibility, a lack of capacity and poor communication between state institutions. This is clearly a failure of the system — a failure by those responsible for security and by the state machinery as a whole,” he said.
Vartanian also suggested publishing the IP addresses linked to the attack. If the authorities cannot establish where they came from, outside specialists could help identify them. He said the three agencies responsible for digital security were failing to work together effectively.
Politician Olesea Stamate sees the problem as one of appointments and institutional culture.
“Nepotism comes at a high price. We have seen just how high in recent days,” she wrote.
“Professionals who ask uncomfortable questions are pushed aside or leave. Those who remain are the ones who cause no trouble. Loyalty becomes the only criterion,” she added.
Stamate said the security checks focused on the application requesting access to data, rather than verifying who was making the request. There was no automatic warning system and no clear procedure for responding to an incident.
She does not believe the breach was the work of some extraordinarily gifted hackers. The real problem, in her view, is that people who lack the necessary expertise have been put in positions that should be held by qualified professionals.
Six Countries, Two Audits — and Still No Suspects
More than two weeks have passed since the attack, but the authorities have yet to name anyone responsible.
Lilian Carp, head of Parliament’s National Security Committee, said investigators had traced access to the databases to six countries, including EU member states and countries in Oceania. He declined to identify them, saying that information should come from the Prosecutor’s Office.
The authorities are planning two separate audits. One will examine how the breach happened; the other will seek to establish who organised it. The systems recorded more than six million requests during the four-day attack.
The heads of the Information and Security Service (SIS) and the police have refused to discuss the investigation in detail. The Prosecutor’s Office has opened a criminal case into unauthorised access to an information system.
Carp has not ruled out internal sabotage. The intrusion went unnoticed for days, despite the institutions responsible for protecting the systems. He also questioned the security of the country’s infrastructure and the lack of coordination between government agencies.
“I prefer to deal in information that has been verified. […] There are IP addresses located outside the Republic of Moldova. That means the institutions involved are outside the Republic of Moldova. […] Neither of these two things happened. This points to a possible conclusion — though it still needs to be verified — that foreign state actors were involved,” Carp said.
He confirmed that the list included IP addresses from European countries but would not say which ones.
“Yes, IP addresses from some countries, including European countries, are on the list. But I cannot say that with certainty,” he said.
The number of people affected remains another unresolved issue. The authorities initially spoke of 750,000 victims. Sandu later put the figure at around 450,000. After the parliamentary hearing, Vartanian said the actual number was substantially below 750,000. The audit is supposed to establish the final figure.
Tofan has pointed to foreign state actors. Parliament Speaker Igor Grosu has spoken of “Russia’s hand”. Carp, however, says he will stick to verified information. He also cautioned that investigators still need to trace the IP addresses through the companies that sold them. According to him, some of these companies are set up by foreign intelligence services and shut down after an attack.
There are still more questions than answers. Who was supposed to monitor the government systems? Why did millions of requests trigger no alarm? Who had access to the stolen data? When did the authorities realise they had been breached? And why have citizens still not been given a clear account of exactly what information was compromised?
AGE is expected to notify those affected in the coming days. A report is due by the end of the month. Vartanian believes it will probably be made public.
For now, the authorities have disclosed six countries and announced two audits.
They have yet to name a single culprit.
