Banks, non-bank lending institutions, and fintech companies are required to protect their customers' personal data. In the banking sector, information security lapses can lead to sanctions even before a large-scale data breach occurs. But when data is extracted from government systems, citizens are advised to remain vigilant, while government agencies report that services have been restored. Will the government hold its own institutions and their leaders to the same high standards as it does the private sector under its oversight?
A cyberattack on Moldova's government digital services has made this comparison quite relevant. According to a preliminary assessment by the e-Government Agency, published on October 27, 2026, the attackers extracted datasets linked to approximately 750,000 personal identification numbers. This is a serious failure in the protection of information entrusted to the state. To put this into perspective: this number is comparable to roughly two-fifths (40%) of the country's adult population, as recorded in NBS statistics.
The compromised information may have included names, dates of birth, photographs, information about relatives, pensions, benefits, disabilities, vehicles, real estate, companies, IBAN bank account numbers, tax debts, and MPay payment histories. Even individual pieces of information can help scammers more convincingly impersonate government employees or the victim's relatives.
According to the official explanation, the attackers exploited vulnerabilities in services accessible without authentication and used the information obtained to extract further data. As a precautionary measure, 82 digital services, more than 30 information systems, and administrative panels were taken offline on October 23. Subsequent access attempts, according to the agency, were blocked.
Stopping the attack limits further damage, and restoring services allows people to use them again. However, neither of these actions returns the stolen information to the government's control. A password can be changed. But a date of birth, family ties, or payment history—no. Technically resolving the incident and addressing its consequences for citizens are two entirely different matters.
The decisions of the National Bank of Moldova for 2024–2026 show that information security controls in banks have practical consequences. In June 2024, Moldindconbank received a written warning for a range of deficiencies, including technology risk management and information security. The warnings to senior management concerned, in particular, access control, vulnerability and incident management, and business continuity. In May of that same year, violations of technology risk management were among the grounds for a warning issued to EuroCreditBank, and in October 2025, to maib.
Financial penalties were also imposed. In December 2025, Energbank was fined 3.13 million lei, and in September 2026, Comerțbank was fined 0.96 million lei. In both cases, the grounds for the sanctions included violations related to technological risks and information security, along with other shortcomings. Comerțbank contested the amount of the fine. Thus, this reflects the regulator's supervisory practice regarding various banks, rather than a single isolated case.
The purpose of such oversight is to identify security weaknesses before they result in damage. The regulator examines access controls, the operation of internal systems, compliance with regulations, and the actions of responsible personnel. Government platforms that consolidate data on a significant portion of the population require an equally rigorous approach.
The mere fact of a successful cyberattack does not in itself prove negligence on the part of a specific manager. However, the criminal actions of attackers do not exempt those responsible for information security from scrutiny. It is necessary to determine when the security of the services was last tested, whether vulnerabilities were known, and whether recommendations for addressing them were implemented. The search for attackers and the evaluation of government agencies' performance must complement one another.
Personal data legislation applies to both businesses and government agencies. A citizen's consent is only one of the grounds for processing data: information may also be used to fulfill a contract, a legal obligation, or a task in the public interest. However, neither a signed consent form nor an agency's authority waives the obligation to protect information. Properly documented processing does not compensate for security deficiencies.
Citizens are particularly vulnerable in this regard. They are required to provide information to the government to obtain documents, process payments, or fulfill tax obligations. At the same time, it is impossible to choose a different government registry administrator, just as one cannot choose a different bank. The government obtains information by virtue of its authority and, therefore, must be responsible for its security, taking this dependency into account.
There is also an economic aspect to this digital dependency. Following the attack, services for submitting applications and issuing permits for entrepreneurs were temporarily unavailable; on October 26, the authorities announced that these services had been restored. In other words, as this incident demonstrated, the security of government platforms also affects businesses' ability to complete necessary procedures in a timely manner.
For those affected, the outcome of the investigation must have practical significance. As the circumstances are established, people need to be informed whether their data has been compromised, what information has been disclosed, and where to turn if they discover unauthorized use. A general call to "be more careful" is helpful, but it leaves people with too little information to assess their own risk.
A report on restored services cannot substitute for accountability. Even a fine imposed on a government agency is insufficient if it is paid for out of the budget: taxpayers end up footing the bill once again. We need conclusions regarding the actions of specific officials and decisions commensurate with the violations identified, including personnel decisions.
This case tests not only the security of government platforms but also the state's ability to apply to itself the same standards it imposes on others. If the matter ends with nothing more than restoring access and issuing warnings about scammers, the risks associated with the data breach will remain with citizens, and the responsibility for protecting their data will exist only on paper. // 29.10.2026 - InfoMarket.