Preliminary information and advice for citizens in the context of the security incident affecting government e-services

       The Public Institution “e-Governance Agency” (AGE) has notified the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) of a personal data breach identified in certain government electronic services.

       According to the preliminary information reported by the AGE, following technical investigations conducted by the AGE in cooperation with the Public Institution “Information Technology and Cyber Security Service” (STISC) and the Agency for Cyber Security (ASC), approximately one million attempts to unlawfully extract personal data sets and around 750,000 data sets potentially extracted without authorization have been identified. These figures are preliminary and may be updated following further verification and the elimination of any potential overlaps.

       According to the notification submitted, as well as information publicly disclosed by the AGE, the potentially affected information includes the following categories of personal data:

• Identification data: first name, last name, personal identification number (IDNP), date and place of birth, and photograph;
• Family-related data: information concerning parents and children;
• Health and social protection data: insured person status, family doctor, social benefits, pensions and disability status;
• Property and economic activity data: driving licence, owned vehicles, and companies owned or managed;
• Financial and tax data: IBANs, tax liabilities and debts, and payment history through the government electronic payment service MPay.

       This list reflects the preliminary assessment of the potentially affected information and does not mean that all categories of personal data were extracted for each individual or through each of the services concerned.

       The unauthorized disclosure of personal data may expose data subjects to certain risks (such as identity theft, financial fraud, social engineering attempts and other forms of abuse). However, the occurrence of a personal data breach does not automatically mean that the affected data will be used for fraudulent purposes. The assessment of risks must be based on confirmed information and the findings of the competent authorities.

       Law No. 195/2024 on personal data protection establishes that personal data must be processed lawfully, fairly and transparently, for specified and legitimate purposes, and must be limited to what is necessary. Furthermore, controllers are required to ensure the accuracy of personal data and their security, including protection against unauthorized access and processing, through appropriate technical and organizational measures.

       In the event of a personal data breach, the controller is required to notify the Center without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The AGE has notified the Center of the reported incidents.

       Under the law, where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate the breach to the data subjects without undue delay. Where individual communication would involve disproportionate effort, public communication or another equally effective measure may be used. At this stage, it has been established that the AGE has taken steps to inform citizens through public communication channels.

       It should be noted that the Center does not manage databases or filing systems and is not empowered to ensure the security and confidentiality of personal data processed within such databases or systems. Under the applicable legal provisions, controllers operating databases or filing systems are required and responsible for implementing appropriate technical and organizational measures to ensure an adequate level of security.

       Within the limits of its legal powers, the Center supervises, monitors and investigates compliance with personal data protection legislation. In this case, the circumstances identified and the measures taken by the Center will be communicated publicly.

       To reduce the risk of fraud or misuse of personal data, the Center recommends that individuals:

• Remain vigilant when receiving suspicious phone calls, text messages or emails.
• Do not disclose passwords, authentication codes or other confidential information.
• Do not click on unsolicited links or authorize payments at the request of unknown individuals.
• Verify unusual requests by contacting the relevant institution or bank directly through official communication channels.
• Verify, using a previously known phone number, any message from someone close claiming to have changed their phone number or account.
• Do not react impulsively to alarming messages involving family members or urgent situations. Always verify the information first.
• Report any suspected unauthorized use of personal data or attempted fraud to the police, bank, the Center or the competent cybersecurity authorities, as appropriate.

       The Center reiterates the importance of protecting personal data and using electronic services with caution. In this regard, responsibility for the security of processed personal data rests with controllers, who must adopt appropriate measures to prevent unauthorized access and safeguard the rights of data subjects.

       Individuals who believe they may have been affected by the personal data breach in the context of the cyberattack targeting public digital services are entitled to contact the relevant controller for clarification and, where appropriate, to exercise their rights guaranteed under the Law No. 195/2024 on personal data protection.