# Moldova Government Systems Cyberattack Exploiting Unauthenticated Services, ~750,000 ID Records Accessed (Oct 19-23, 2026)

> Between October 19 and 23, 2026, attackers made roughly 11 million requests against Moldovan government digital services, exploiting vulnerabilities in unauthenticated services and extracting data tied to about 750,000 identification numbers. More than 30 government information systems were temporarily disconnected; unauthorized access was blocked on October 23, and authorities are investigating possible foreign state involvement without public attribution.

- **Published:** 2026-10-28T17:04:51Z
- **Last reviewed:** 2026-10-28T17:04:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4659
- **ID:** TL-2026-4659
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Moldovan officials, including the Prime Minister and the Electronic Governance Agency, disclosed a large-scale intrusion into government information systems that ran from October 19 to October 23, 2026. According to The Record (Recorded Future News), the attackers made approximately 11 million access requests and exploited vulnerabilities in unauthenticated government services. They then used the information they obtained to reach interconnected systems. Local reporting (Informat.ro) places the peak of activity on the night of October 22, when public services recorded about 11 million access requests, and states that the attackers sought to illegally obtain personal data.

Data tied to approximately 750,000 identification numbers was extracted. Exposed data categories reported by officials include names, birth dates and places, family relationships, health insurance status, social benefits, pensions, disability records, driver's licenses, photographs, vehicle ownership details, bank account numbers, tax debts and government payment histories. Officials inspected 82 digital public services; services reported as affected include online construction permit applications, veterinary transport authorizations, medicine imports and food safety registrations.

Response: unauthorized access was blocked on October 23, and more than 30 government information systems and administrative panels were temporarily disconnected while the Electronic Governance Agency, the Cybersecurity Agency and the Information Technology and Cybersecurity Service inspected infrastructure and ran security audits. Roughly 15 specialists worked continuously from October 23. On October 26 (Sunday) and again on Tuesday, further access attempts were detected and blocked, and several digital public services remained unavailable. Services are being restored gradually after audits.

Attribution: no country or group has been named. Authorities are investigating possible involvement of foreign state actors. Context: Moldova has faced repeated cyberattacks since Russia's 2022 invasion of Ukraine, including a 12-hour DDoS campaign against the Central Electoral Commission on September 28, 2025 (898M+ malicious requests mitigated per Cloudflare) and an April 2026 breach of the National Health Insurance Company (CNAM) where officials considered links to Russian actors. Those are context only; no source links them to this incident. No CVEs, malware, tooling, or network indicators have been published for this incident. The specific vulnerable services and exploitation technique have not been disclosed.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1119 Automated Collection
- T1213 Data from Information Repositories

## Sources

- [Moldova investigates possible foreign involvement in major government cyberattack](https://therecord.media/moldova-investigates-possible-foreign-involvement-cyberattacks)
- [Cyberattack in Moldova: public platforms unavailable on Monday](https://informat.ro/en/republic-of-moldova/cyberattack-in-moldova-public-platforms-unavailable-on-monday-145191)
- [Moldova health insurance agency reports possible data leak after cyberattack](https://therecord.media/moldova-health-insurance-agency-reports-possible-data-leak-cyberattack)
- [Risky Bulletin: The mysterious hack of Moldova's healthcare database](https://news.risky.biz/risky-bulletin-the-mysterious-hack-of-moldovas-healthcare-database/)
- [Helping protect the 2025 Moldova elections (Cloudflare)](https://blog.cloudflare.com/helping-protect-the-2025-moldova-elections/)
- [Moldova, facing cyberattacks as part of alleged Russian coup plan, asks for Western support](https://therecord.media/moldova-facing-cyberattacks-as-part-of-alleged-russian-coup-plan-asks-for-western-support/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4659