October 27, 2026: Moldova's Electronic Governance Agency (AGE) said data tied to about 750,000 national ID numbers (IDNP) was extracted without authorisation from public digital services. The agency's figure is preliminary. Canonical: moldova-age-digital-services2026. Primary source: the agency's announcement, as reported by Zugo (Romanian).
The AGE runs the digital services that Moldovan citizens use for everyday needs, including benefits, pensions, driving licences and insurance status. Headlines often say the attack reached 750,000 people. The official unit is the national ID number, the IDNP, so one person can account for more than one record.
What happened
- October 19 to 23: attackers tried to reach information tied to about one million IDNPs.
- October 23: the extraction was halted.
- October 25: a new forced-access attempt was blocked.
- October 27: further extraction attempts failed. The agency announced the preliminary figure of about 750,000.
Authorities suspended 82 digital public services and disconnected more than 30 information systems and admin panels. Most of the affected services have been restored, and the rest will return once their security has been reconfirmed.
Technical analysis
According to the agency, the attackers exploited weaknesses in services that could be reached without logging in. They then used the data they obtained to extract more. The agency has not said who is responsible, and the investigation is ongoing. The prime minister, Vasile Tofan, has warned that attacks of this kind may become more frequent.
Impact
The agency's list of fields is narrower than the headlines. It includes names, dates and places of birth, first-degree family information, insurance status, family doctor, social benefits, pensions, disabilities, driving licences and photographs.
Media reports add possible financial data, including IBANs, tax debts and MPay payment history. The authorities say bank card information was not affected. The agency also notes that knowing an IBAN alone does not give access to a bank account or allow an unauthorised transfer.
Verified vs unverified
- Verified (agency): the preliminary figure of about 750,000 IDNPs, the entry through services that need no login, the halt and blocked attempts, the 82 suspended services, and the list of fields.
- Press-reported: the financial fields (IBANs, tax debts and MPay history). The authorities say card data was not affected.
- Not confirmed: the attacker, the total number of people affected, and whether the data has been published or sold.
What to do
- Be careful with calls and messages about benefits, pensions, driving licences or your family doctor. These are the fields exposed, so they are useful for a convincing approach.
- Do not give your IDNP, bank details or a code from your bank to anyone who contacts you, even if they seem to know your details.
- Use the official government channels to check on a service, rather than a link in a message.
- Review your bank statements if you have an account linked to a government service, and contact the bank directly if something looks wrong.
- Change the password on any government e-service account you use, and do not reuse it elsewhere.
What an IDNP is and why it matters
The IDNP is Moldova's national personal identification number, the counterpart of Romania's CNP. Its exposure matters more than a single service's data because the number can connect records held in different systems: benefits, pensions, vehicles and family details can all be tied to one identifier. The agency's count is of the numbers whose data sets were extracted, not a named list, so a reader should not assume the figure excludes them.
That linking is also why the agency's note on IBANs is useful. Knowing an IBAN is not the same as having access to the account, and the agency says an IBAN alone does not allow an unauthorised transfer. The risk lies in combining identity, benefit and contact data so that a scammer's request sounds routine.
Services that were suspended
The agency calls the figure preliminary. It says the exact scope is subject to a broad audit and to investigations by the cybersecurity agencies and the AGE itself, so the number may change.
Authorities reviewed 82 digital public services and suspended those exposed to risk. They also disconnected more than 30 information systems and admin panels as a precaution. Most of the affected services have been restored, and the rest will return once their security is reconfirmed. The sources reviewed for this post do not name the affected services, so the 82 figure is a count rather than a list. Anyone who cannot reach a service should check the agency's official channels for its return, rather than trust a message that offers to restore access.
Sources
Zugo: the agency's announcement (Romanian) • Antena 3 (Romanian) • DataBreaches.net, October 27, 2026
Related reading
Moldova's health-insurance agency was also hit this year, in our CNAM post. For another government-held identity-number exposure, read our University of Copenhagen post.