Moldova’s digitalisation minister fails to explain massive data breach

Moldova data breach leaves minister unable to answer key questions

Moldova’s Minister of Economic Development and Digitalisation Claudiu Năsui struggled to provide clear answers during a press conference about the massive exposure of citizens’ personal information. Despite repeated questions from journalists, he failed to clarify whether the authorities had received advance warnings about vulnerabilities in the country’s digital infrastructure.

The minister was asked whether Chișinău had received a security alert issued by European institutions on 21 October. Rather than confirming or denying its receipt, Năsui avoided giving a direct answer.

“Let me come back to that once we have all the information.”

Journalists pressed him further, but the minister continued to offer general explanations about being under “constant siege” and facing a shortage of resources. When asked why his ministry had failed to address apparent security weaknesses over the past three years, he declined to comment on matters he described as falling outside his remit.

He eventually promised to return with a package of information once the investigation was complete. For the public, however, the press conference provided little clarity about the Moldova data breach, what caused it or whether the authorities had ignored earlier warnings.

The incident is hardly unique to Moldova. Similar failures have affected considerably wealthier countries with more developed digital infrastructure. What differs is how governments respond when citizens’ private information falls into the wrong hands.

Data breaches in Belarus, Poland and Denmark expose wider failures

In Belarus, personal information from the government service Obrashcheniya.bel reportedly appeared in a Telegram bot used to search leaked databases in early October.

The exposed records allegedly included names, telephone numbers, email addresses and the contents of complaints submitted to state institutions. The reported leak affected hundreds of thousands of people, yet state media made no major announcement about the scale of the incident.

The compromised information reportedly even included correspondence from the director of the state company responsible for developing the service and an employee of a government newspaper. Despite the apparent seriousness of the breach, no officials were reported to have lost their positions. Instead, the public saw notices concerning technical work on the service and little explanation of who was responsible.

The response in Poland was considerably more public. Hackers reportedly gained access to medical records belonging to 19 million patients, with the data protection system managed by MyDr.

The disclosure triggered a political controversy. MPs from Law and Justice (PiS) demanded an emergency meeting of the parliamentary digitalisation committee and called on the responsible minister to explain how such a breach could occur.

In the Sejm, lawmakers questioned why this was the second major incident in two years and who had allowed systemic vulnerabilities to remain unresolved. Deputy Digitalisation Minister Michał Gramatyka appeared before parliament, explaining that the information had not been offered for sale and that the hackers had allegedly been testing the system.

A criminal investigation was opened into unauthorised access, while changes to personal data protection legislation were also being pursued. Unlike in Minsk, the incident prompted parliamentary scrutiny and a wider political debate. Whether that scrutiny will ultimately produce accountability is another matter.

Denmark reportedly experienced an even more extraordinary security failure. According to the account, a hacker accessed the national Central Person Register (CPR) through an account belonging to a small IT company, exposing names, addresses and identification numbers associated with 8.8 million people.

The intruder allegedly claimed that the password used to gain access was simply “123456”, a combination notorious for its weakness. The Danish authorities acknowledged the breach but focused their response on strengthening security rather than allowing the episode to become a prolonged public scandal.

The case illustrates how even basic weaknesses in access controls can undermine systems entrusted with highly sensitive personal information.

France and Japan face major leaks without ministerial resignations

In France, a series of reported cyberattacks targeted government services including ANTS, FICOBA and EduConnect, potentially exposing millions of records.

The attack on the portal responsible for passports and driving licences reportedly exploited a basic design weakness: changing a single digit in a request could allow access to information that should have remained protected.

This was not a sophisticated technique requiring extraordinary computing power, but an apparent failure in the way the system controlled access to records. The government of Sébastien Lecornu acknowledged the breach and allocated additional funds to modernise data protection.

Meanwhile, a 15-year-old boy was prosecuted in connection with unauthorised access to government systems. On 25 April, he was charged with illegally accessing and extracting data and placed under judicial supervision.

The teenager reportedly faces up to seven years in prison and a €300,000 fine. The case was reported alongside criticism of the government’s cybersecurity response, while no ministerial resignation was reported.

The contrast is striking: a teenager faces potentially severe criminal penalties, yet the question of responsibility for longstanding security weaknesses remains unresolved. Japan has faced its own series of data breaches involving private service providers and information aggregators.

Reported incidents affected Sky Ticket, involving 14 million records; So-net, with 2.58 million; and Book Off, with 6.4 million. A separate attack on the government network of the Digital Agency in September reportedly exposed information belonging to 246,000 public employees.

Digital Minister Hisashi Matsumoto acknowledged the incident and apologised to those affected, but remained in office. The reported rise in Japanese cybersecurity incidents suggests that outsourcing and reliance on private technology providers can create additional points of vulnerability.

For citizens, however, whether their information was exposed through a government database or a private contractor makes little practical difference. The consequences of a breach remain theirs to bear.

US Marines take the Pentagon to court over personal data

The response in the United States offers a different example of how citizens can seek accountability. A reported breach involving the Pentagon’s Defense Manpower Data Center (DMDC) exposed information concerning approximately 2.76 million military personnel and veterans, including Social Security numbers.

On 20 October, serving US Marine Tristin Edwards and veteran Morgan Stumpfli filed a class-action lawsuit against the US Department of Defense, alleging violations of the Privacy Act of 1974. The plaintiffs accuse officials of negligence and of ignoring earlier warnings about weaknesses in the department’s information security.

According to the allegations, the Inspector General had been drawing attention to problems since 2021, but the necessary action was not taken. The lawsuit seeks $5 million in compensation for those affected, a comparatively modest amount when divided among the millions of people whose records were reportedly compromised.

The Department of Defense has reportedly offered a year of free credit monitoring as a proposed settlement measure. Whether that offer will satisfy the claimants remains unclear, as the proceedings are only beginning.

The case, discussed in a report on the federal data breach and legal action, demonstrates that those affected need not limit themselves to waiting for official explanations. They can also attempt to hold the institution responsible through the courts.

Who is held accountable when citizens’ data is exposed?

These incidents share a troubling characteristic: the consequences for the officials responsible for protecting personal information appear limited, even when the reported breaches involve millions of people.

In Belarus, the response was largely confined to technical explanations. In France, a teenage suspect faced prosecution while questions remained about the security failures that enabled the attack. In Japan, the responsible minister apologised but retained his position.

Poland offered greater parliamentary scrutiny, while the American case shows how affected citizens can seek compensation directly from a government institution. The contrast matters for Moldova, where Claudiu Năsui has so far been unable to explain whether his ministry knew about the vulnerabilities that preceded the latest breach.

The question is not whether cyberattacks can be prevented entirely. No government can credibly promise that. The question is whether officials act on warnings, maintain adequate safeguards and accept responsibility when those safeguards fail.

Parliamentary hearings and ministerial statements may generate publicity, but they do not necessarily establish personal or institutional accountability.

The American lawsuit suggests one possible route for citizens seeking answers beyond official press conferences. Even a powerful institution such as the Pentagon can be challenged in court over its handling of personal information.

For Moldova, the immediate questions remain unanswered: did the authorities receive the 21 October warning, why were the vulnerabilities not addressed, and who will be held responsible if negligence is established?

Until those questions receive substantive answers, promises of further investigations and future reports will offer little reassurance to citizens whose data has already been exposed. And if officials face no consequences for failing to protect that information, there is little reason for the public to believe the next Moldova data breach will be handled any differently.