Moldova cyberattacks expose gaps in data protection
Cyberattacks targeting Moldova's digital public services have raised concerns about personal data protection, with expert Sergiu Bozianu warning that exposed information could fuel future fraud.
Data protection measures under scrutiny
Bozianu said the incidents between October 22 and 25 showed that existing safeguards were not sufficient to protect citizens' personal information.
He noted that some access attempts appeared to have taken place at night, when public services are generally not operating. In many cases, the stated purpose in users' personal accounts was “updating civil status records.”
“What happened allows us to draw a clear conclusion: we are highly developed in terms of digitalisation and public services. However, when it comes to personal data protection, this incident demonstrates that existing measures are insufficient to ensure an adequate level of protection. We are vulnerable,” Bozianu said on Radio Moldova's “Zi de Zi” programme.
The expert called for a public audit to establish how the incidents occurred. He said digital services can make public administration more accessible and reduce costs, but must be backed by security measures that give citizens confidence that their information is protected.
Personal data could fuel fraud
Bozianu warned that the risks extend beyond unauthorised access. Names, addresses and other personal details could be used in scams involving telephone calls or messages from people posing as public officials or bank representatives.
“Unfortunately, this information is not for single use. If the data was illegally collected by certain groups, organisations or other entities, it could be used in various fraudulent schemes,” he said.
The information could also be used to apply for loans in other people's names, open bank accounts or carry out other fraudulent transactions. Other potential risks include the disclosure of confidential information, surveillance, stalking and manipulation through social engineering.
Artificial intelligence could further increase these risks, the expert warned.
How citizens can check their data
Citizens are advised to check whether their personal information has been accessed and remain cautious when asked to disclose sensitive details, even when a request appears to come from an official institution.
Access records can be checked through the EVO platform, the personal account or the available web service. Authentication with an electronic signature is required.
Public authorities are responsible for how personal data is collected, stored, used and protected, Bozianu said.
“Public authorities are personal data controllers under the new legal framework on data protection. They are responsible for how personal data is collected, stored, used and, where necessary, protected. Therefore, public authorities must explain to us what happened,” he said.
Citizens can request information about the data held by an institution and how it is processed. Subject to applicable legal conditions, they can also request corrections or deletion, object to certain forms of processing, seek restrictions on processing or file a complaint with the competent data protection authority if they suspect their information has been handled unlawfully.
11 million access requests recorded
The cyber incidents affected several of Moldova's digital public services, with attempts to obtain personal data reported between October 22 and 25.
Authorities recorded approximately 11 million access requests during the night of October 22, in what they described as an attempt to obtain personal data illegally.
The attack was stopped the following day. Authorities then disconnected the affected services as a precaution to prevent unauthorised access to information.
The services were fully restored on Monday morning, October 26, according to the source report.
Translation by Iurie Tataru
RELATED COVERAGE
