Moldova is investigating possible foreign involvement in a cyberattack on government services. The country's Electronic Governance Agency disclosed that hackers had exploited vulnerabilities in government services to extract large volumes of personal information between October 19 and 23. Preliminary findings point to information covering about 750,000 identification numbers.
What happened
According to the agency, the attackers made approximately 11 million requests to access data through government services. Preliminary findings indicate that information covering about 750,000 identification numbers was extracted, although not every affected individual had all categories of personal data exposed.
The compromised information may include names, dates and places of birth, family relationships, health insurance status, social benefits, pensions, disability records, driver's licenses, photographs and vehicle ownership details.
Authorities said they blocked unauthorized access on October 23 but detected additional attempts to breach government services on Sunday and Tuesday. The statement about possible foreign involvement came a day after the agency's disclosure. No actor has been confirmed.
How it was done
The public account describes exploitation of vulnerabilities in government services to extract personal information over a five day window. The volume is the clearest signal. Approximately 11 million requests were made to access data through those services, and the result was a bulk extraction across identification numbers rather than a single record lookup.
In response, authorities inspected 82 digital public services and temporarily disconnected those considered vulnerable, along with more than 30 government information systems and administrative panels.
No further technical detail on the specific flaws has been made public.
What to check
If your organisation runs citizen facing or customer facing lookup services, these checks are a reasonable starting point.
Rate limit identity lookup endpoints
List every endpoint that returns personal data keyed by an identifier, then check whether a limit exists per token, per source address and per account. Send a scripted burst against a staging copy and watch for 429 responses. If the burst completes cleanly, the control is missing.
Test object level authorisation
Take a valid session and request records belonging to another subject by changing the identifier in the path or body. Any 200 response with another person's data is a broken access control finding. Repeat for every API version still routable, including older paths left in the gateway.
Hunt for bulk read patterns in logs
Query your access logs or SIEM for distinct identifiers requested per client per hour, not just request counts. A single client touching thousands of unique subjects is the pattern to alert on. Save that query as a standing detection rather than a one time check.
Inventory exposed admin panels
Scan your public ranges for administrative interfaces and internal consoles that answer from the internet. Confirm each one sits behind network restrictions or a verified identity gateway. Anything reachable without authentication should be disconnected now and reviewed later.
Confirm field level data minimisation
Review responses from your main lookup services and compare the fields returned against what the caller actually needs. Health, benefit and document fields returned by default widen the impact of any single flaw. Trim them at the serialiser, not in the client.
Re-test after blocking
If you block an access path, schedule a follow up test for variants, different encodings, alternate hosts and unpatched replicas. Keep monitoring at a raised level for days afterwards. Repeat attempts against the same service are common.