The Fallout from a Personal Data Breach: What Moldova Could Face

Last week, hackers stole 750,000 data records linked to the personal identification numbers of Moldovan citizens. Yet what is most striking is not the scale of this latest PAS failure, as the public has long grown accustomed to the regime’s incompetence and culture of mutual protection, but the way the authorities have responded to the incident

The stolen data includes not only citizens’ IDNPs and personal details (first and last names), as well as information about their close relatives, but also records relating to health insurance, vehicles, pensions and social benefits, bank account numbers, outstanding debts and payment histories. Even the range of information exposed points directly to its potential value to telephone scammers. It matters little whether the data was commissioned by scammers themselves or whether the hackers independently acquired a commodity for which there is guaranteed demand. This is particularly true at a time when opportunities for cross-border criminal activity involving Moldovan infrastructure are being curtailed by investigative efforts on the part of US intelligence agencies and growing political discontent within the European Union. If organizers of telephone scam operations face restrictions on accessing the United States, EU member states and Israel as a result of clear political signals and growing logistical difficulties for their couriers, criminal groups will be forced to shift from an extensive to an intensive model. In other words, instead of constantly expanding the geographical reach of their calls, they will seek to maximize their impact in territories where law enforcement agencies are not actively combating them. In this respect, Moldova has long been under suspicion. The opposition has repeatedly accused the authorities of facilitating telephone scam operations, often going so far as to name specific individuals. Rumors are emerging that the leak was not the result of a targeted hacker attack. Instead, the databases may have been leaked or simply sold for less than popular platforms such as Facebook and YouTube spend on specialized tools for tracking user preferences in order to deliver so-called targeted advertising. The figures are also significant. The scale of the leak effectively mirrors the number of pensioners in the country, which stood at 670,000-675,000 in 2026. This gives rise to the impression that information specifically relating to Moldovan pensioners was deliberately taken from the Electronic Governance Agency, or purchased from someone within it. The data is particularly revealing in terms of the profiles it contains, closely matching what one would expect telephone scammers to seek for analytical purposes: information about property, vehicles, bank accounts, debts and payment histories. Today, any AI system can analyze the entire dataset within a matter of hours and identify individuals who are potentially financially well-off and therefore of particular interest for further targeting. From there, it is simply a matter of applying techniques that have been tried and tested many times before, including on Moldovan soil. If our law enforcement agencies continue to turn a blind eye to telephone fraud, or even shield those involved, the data breach could become a gold mine for its beneficiaries. In effect, the authorities may have turned tens of thousands of their own elderly citizens into easy targets for criminals, effectively providing them with a tip-off by allowing the data to be run through AI-powered filters to identify those who may have financial resources matching the scammers’ interests. Officials’ assurances that access to credit card accounts was not compromised are beside the point: the leaked information is more than sufficient for professionals in this line of business. This raises the question of whether the leak from the Electronic Governance Agency was an act of incompetence, namely a failure to properly assess the full range of risks and take adequate measures to address them, or an act of corruption and sabotage, involving the sale of citizens’ personal data to telephone scammers and effectively handing them over as easy prey. An important aspect is the way senior officials have responded to the incident. It is clear that a reaction from Maia Sandu to yet another scandalous and politically toxic episode will, as usual, take a considerable time to materialize. Meanwhile, Vasile Tofan, who heads the government, has clearly sought to downplay the seriousness of what happened. He pointed out that the risks of data theft would continue to grow, implying that Moldova had got off relatively lightly this time. Serghei Diaconu, head of the Crisis Management Centre, pointed to the shortcomings and outdated nature of the personal data protection infrastructure. This is particularly unacceptable amid yet another push to digitize key personal and economic records across the country. Nicoleta Colomeet, the head of the agency and the official directly responsible for the failure, has stepped down from a position that paid her around €5,000 a month, but has promised to “remain part of the team”. The impression is that no one intends to address the substance of the crisis. No one will be protecting Moldovan pensioners, particularly any who may still have substantial financial means, from attacks by cybercriminals. For those in power, the only priority now is to cling to their positions, stage yet another crisis-management exercise and prevent anything from threatening PAS rule. That is why the government’s compliant media outlets and its tame experts have begun cherry-picking examples of supposedly similar data leaks in EU countries. At the same time, the government, of course, was quick to point to the alleged subversive activities of a foreign country. It would come as no surprise if Chisinau eventually blamed Russia for the whole affair. This would serve to keep tensions high, muddy the waters, evade responsibility for everything and, in the process, curry favor with Brussels. The motto of Maia Sandu’s government could well be: “Everything is for sale, including the country’s citizens, wholesale and retail. But Russia is to blame, because European integration”.