The October cyberattack targeted infrastructure managed by Moldova’s Electronic Governance Agency, President Maia Sandu has announced. The vulnerability was that the systems verified only the application requesting the data, but did not check the identity of the user or whether they were authorised to access the information. As a result, a single application with faulty access controls opened registers belonging to at least 10 institutions, the head of state said.
The attackers had obtained a set of national identification numbers (IDNPs), which they used to gain further access to the system. Another weakness was the lack of controls over the volume of data accessed and the absence of appropriate alerts.
Automated requests from more than 638 IP addresses began on the evening of October 19. The most intensive day was October 20, when approximately one million access requests were recorded in a single day. More than 260,000 records containing information about relatives were also extracted that day. On October 21, the Electronic Governance Agency stopped the extraction of this type of information.
The process of blocking the attackers began on October 23 and was completed on October 24. From that point on, the hackers were no longer able to access Moldovan citizens’ personal data.
“Communication from state institutions about the incident was delayed and did not address all of the public’s concerns. The lack of a communication protocol for such situations led to uncertainty over responsibilities and responses. The latest assessments show that data belonging to approximately 450,000 people was accessed,” the president said.
Authorities initially reported that the data of approximately 750,000 people had been accessed. The figure was subsequently revised downwards. The difference was due to the fact that authorities did not initially have all the necessary information and had relied on estimates.
Sandu also announced plans to introduce cybersecurity education in schools and provide practical guidance to the public.
“We have agreed that state institutions, including the Ministry of Education, will prepare a model lesson for middle and high school students, explaining several basic rules for protecting personal data. These include avoiding overly simple passwords or using the same password across multiple platforms, changing passwords regularly, enabling two-factor authentication for email accounts, social networks and other applications, being especially careful with suspicious links and free offers, as well as using other technical solutions.
“We hope that young people will subsequently be able to help their parents become more vigilant and better protected. A simple personal data protection guide will also be prepared, with clear instructions for all citizens,” Maia Sandu announced.
A working group is also expected to be established within the Government, under the coordination of the Prime Minister, to identify solutions to the country’s cybersecurity challenges.
The National Security Council will meet again in three months to examine the proposed measures, the president added.