Moldovan President Maia Sandu has called a meeting of the country's National Security Council (CNS) days after a large-scale cyberattack on government information systems.
The attack, most likely carried out with the help of artificial intelligence, resulted in the extraction of personal data belonging to approximately 750,000 Moldovans.
On October 29, Sandu's office announced that the meeting would take place in "the coming days to assess the attack and determine appropriate response measures."
The head of the country's Cybersecurity Agency, Mihai Lupascu, told RFE/RL that "without a doubt, this is the most impactful...largest cyberattack recorded so far," adding that the operation was "highly sophisticated," "well-prepared," and involved "several waves."
"We are dealing with a situation in which a highly skilled cyberactor carried out these activities with the clear objective of compromising information systems and exfiltrating data," Lupascu said.
Previously, Prime Minister Vasile Tofan told cabinet ministers that there were "indications of a broader campaign involving foreign state actors" and that investigators were looking into "their involvement in the recent incident."
He did not specify which countries were suspected of being involved.
Officials from several European nations have been warning for months of an expanding campaign of hybrid activity -- hostile actions short of open warfare, including cyberattacks, sabotage, and the weaponization of migration -- by Russia amid its war on Ukraine.
Lupascu said that while it was "premature" to definitively attribute the cyberattack to a specific actor, its complexity offered clues about who might be responsible. "At the very least, those behind it have the technical capabilities and infrastructure needed to orchestrate and carry out such attacks."
Wedged between NATO member Romania -- with which it shares close linguistic and cultural ties -- to the west and war-ravaged Ukraine to the east, Moldova has struggled to shield itself from the fallout of Moscow's full-scale invasion.
According to Moldova's Electronic Government Agency (AGE), the attack targeted about one million people, almost half of the country's population, with attempts to extract data associated with personal identification numbers (IDNPs) taking place between October 19 and October 23.
Authorities have preventively suspended 82 digital public services and disconnected over 30 information systems to limit unauthorized access, it added.
The compromised data could include identification details, such as names and dates and places of birth; information about immediate family members; health insurance status and family doctors; social benefits, pensions, and disability status; driver's license details and photographs; vehicles and companies owned or managed; and financial information, including International Bank Account Numbers (IBANs), tax debts, and payment histories.
AGE said bank card data was not affected and that no unauthorized changes were identified in state registers.
The attackers allegedly exploited vulnerabilities in services accessible without authentication, subsequently using the information obtained to attempt additional data extraction.
Authorities said security problems had been addressed in most affected services, while the remaining ones would be gradually restored once security measures had been verified. A broader review of government systems was also under way to identify and fix vulnerabilities.
AGE warned that cyberattacks pose a growing threat to public institutions, with advances in artificial intelligence making it easier to automate attacks and identify security weaknesses.
Lupascu told RFE/RL that he believed artificial intelligence was used in the latest cyberattack on Moldova, "including [capabilities] that allow the identification of vulnerabilities." He added that such tools can identify vulnerabilities "that humans cannot."
"We must be aware that artificial intelligence tools will continue to generate cyberincidents in the next few years," he warned.
