Moldovan President Maia Sandu has convened a meeting of the country's National Security Council (CNS) days after a large-scale cyberattack on government information systems.
The attack, most likely carried out with the help of artificial intelligence, resulted in the extraction of personal data belonging to approximately 750,000 Moldovans.
On October 29, Sandu's office announced that the meeting would take place in "the coming days to assess the attack and determine appropriate response measures."
A day earlier, Prime Minister Vasile Tofan told cabinet ministers that there were "indications of a broader campaign involving foreign state actors" and that investigators were looking into "their involvement in the recent incident."
He did not specify which countries were suspected of being involved.
Officials from several European nations have been warning for months of an expanding campaign of hybrid activity -- hostile actions short of open warfare, including cyberattacks, sabotage, and the weaponization of migration -- by Russia amid its war on Ukraine.
Wedged between NATO member Romania -- with which it shares close linguistic and cultural ties -- to the west and war-ravaged Ukraine to the east, Moldova has struggled to shield itself from the fallout of Moscow's full-scale invasion.
SEE ALSO:
Moldova To Probe Possible Russian Data-Harvesting After RFE/RL InvestigationAccording to Moldova's Electronic Government Agency (AGE), the attack targeted about one million people, almost half of the country's population, with attempts to extract data associated with personal identification numbers (IDNPs) taking place between October 19 and October 23.
Authorities have preventively suspended 82 digital public services and disconnected over 30 information systems to limit unauthorized access, it added.
The compromised data could include identification details, such as names and dates and places of birth; information about immediate family members; health insurance status and family doctors; social benefits, pensions, and disability status; driver's license details and photographs; vehicles and companies owned or managed; and financial information, including International Bank Account Numbers (IBANs), tax debts, and payment histories.
AGE said bank card data was not affected and that no unauthorized changes were identified in state registers.
The attackers allegedly exploited vulnerabilities in services accessible without authentication, subsequently using the information obtained to attempt additional data extraction.
Authorities said security problems had been addressed in most affected services, while the remaining ones would be gradually restored once security measures had been verified. A broader review of government systems was also under way to identify and fix vulnerabilities.
AGE warned that cyberattacks pose a growing threat to public institutions, with advances in artificial intelligence making it easier to automate attacks and identify security weaknesses.