Moldova's government digital services: attackers used flaws in services reachable without authentication to query about one million national identification numbers and extract data on about 750,000 of them between 19 and 23 October, and the Prime Minister says AI allegedly helped find the flaws

Moldova's Electronic Governance Agency (AGE) reported on 2026-10-27 that between 19 and 23 October attackers queried about one million national identification numbers (IDNPs) through state digital services and that, on preliminary estimates, data sets for about 750,000 of them were extracted; MOLDPRES had put the access requests at about 11 million on 2026-10-24 (Moldova Electronic Governance Agency, 2026-10-27; MOLDPRES, 2026-10-24). AGE's technical explanation is that the attackers exploited vulnerabilities in services reachable without authentication and then used the data they obtained for further extractions; the first attacks hit an electronic service that logged the legal basis of processing incorrectly, which is why citizens saw entries for civil-status document requests and driving-licence issue in the data-access history of the EVO app (Moldova Electronic Governance Agency, 2026-10-27). Data that may be affected, not every category for every person, includes name, date and place of birth, first-degree relatives, insured status, family doctor, social benefits, pensions, disability, driving licence, photograph, vehicles and companies owned or run, IBAN, tax debts and payment history; AGE says card data is not held on the platform and it found no unauthorised change to state registers (Moldova Electronic Governance Agency, 2026-10-27).

AGE stopped the extraction on 23 October at 11:30, reviewed 82 digital services and suspended the exposed ones, and its timeline says 82 public services and more than 30 information systems and administration panels were disconnected as a precaution on 23 October; it blocked further attempts on 25 and 27 October, and the Prime Minister's account is that 30 of the 82 services were disconnected (Moldova Electronic Governance Agency, 2026-10-27; MOLDPRES, 2026-10-28). The Prime Minister says the incident is not isolated, that foreign state actors are being investigated and that the attackers automated the extraction, with the use of artificial intelligence allegedly facilitating the identification and exploitation of the vulnerabilities (MOLDPRES, 2026-10-28). Moldova has not attributed the attack to any country or group (The Record, 2026-10-28).