750,000 identities exposed. Who is accountable and who pays?

MP Alexandru Verșinin is calling for an independent investigation into the cyberattack on public digital services and is making available to citizens the complaint form addressed to the National Centre for Personal Data Protection (CNPDCP), together with concrete steps they can take to defend their rights and claim compensation.

Chișinău, 28 October 2026

What happened

According to the Electronic Governance Agency, between 19 and 23 October 2026 approximately one million IDNPs (personal identification numbers) were queried in attempts at unauthorised extraction of personal data. Preliminary estimates show that data sets relating to around 750,000 IDNPs were extracted.

The extraction was stopped on 23 October at 11:30. The authorities preventively disconnected 82 public services and more than 30 information systems, and new access attempts were blocked on 25 and 27 October. The exact scale of the incident is still being verified.

What data is at stake

This is not only about names. According to the official information, the data concerned includes identification data, information about family members, insurance status, family doctor, social benefits, pensions, disability, driving licences, photographs, vehicles, companies owned or managed, as well as financial information – IBANs, tax debts and MPay payment history.

The authorities state that not all affected persons had all of these categories of data exposed, that no changes to state registers have been identified and that bank card data was not affected. Nevertheless, the extracted data may be used in fraud attempts, phone scams and identity theft.

“I am not claiming that every affected citizen has already been a victim of fraud. I am claiming, however, that the extracted data can create real risks, and these risks must not be downplayed.” – Alexandru Verșinin

Who is accountable? Questions to the Government

Remedying the incident does not close the question of accountability. MP Alexandru Verșinin has publicly raised five questions:

1. Who checked the security of these systems before the attack?
2. Who had the obligation to prevent mass data extraction?
3. What security controls were in place, and why did they not prevent the access?
4. Were security audits carried out? What deficiencies did they identify, and who was supposed to remedy them?
5. When will the affected citizens be informed individually?

“A cyberattack does not automatically prove the negligence of an official. That is precisely why we are calling for a serious, independent and transparent investigation. We are not asking for invented culprits. We are asking for those responsible to be identified on the basis of evidence.”

What rights citizens have

Since 23 August 2026, Law No. 195/2024 on personal data protection has been in force, aligning the legislation of the Republic of Moldova with European standards (GDPR). The law gives affected persons three instruments:

• A complaint to the CNPDCP (Art. 72);
• Legal action before the courts (Art. 74);
• The right to compensation for material or non-material damage suffered, from the responsible controller or from its processor (Art. 76).

The law does not set a fixed amount. Each claim must be substantiated and supported by evidence, and compensation is determined according to the circumstances of the case.

“I will not promise you that every citizen will automatically receive 10,000, 20,000 or 50,000 lei. That would be an irresponsible promise. But the right to claim redress for damage exists, and every citizen should know about it.”

What you can do: 5 steps

Step 1 – Download the form. The complaint form addressed to the CNPDCP can be downloaded below. The form is in Romanian, as issued by the CNPDCP. You can print it and fill it in.

Step 2 – First, contact the institution that processes your data. Request official confirmation of whether your data was affected, which categories were compromised and what protective measures were taken. The institution must inform you of the action taken within one month of receiving your request; this period may be extended by a further two months, in which case you must be informed (Art. 12(3)). Keep a copy of your request and the reply: a complaint to the CNPDCP includes, where applicable, information about requests made to the controller and their outcome (Art. 79(1)(g)). Do not automatically assume that all your data was extracted.

You can use the model request to the Electronic Governance Agency (AGE) and the Public Services Agency (ASP), which you can download below and fill in with your details. The document is in Romanian.

Step 3 – Fill in the complaint. State your name, contact details, the institution complained against (if you know it), the circumstances of the incident and the rights you consider to have been infringed. You can ask for the incident to be investigated, the responsible controller to be identified, the infringements to be established and the legal measures to be applied. Attach any evidence you have.

Step 4 – Submit the complaint. Send it to the CNPDCP in the form required by law. An electronic signature is required for electronic submission. Keep proof of sending and the registration number.

Step 5 – Claim compensation if you have suffered damage. Once the responsible controller has been identified, you can claim redress for material and non-material damage. If the claim is not settled voluntarily, you can go to court. The complaint to the CNPDCP and the action for compensation are separate procedures.

What MP Verșinin is requesting from the authorities

As a Member of Parliament, Alexandru Verșinin will request official, documented answers from the competent institutions regarding:

1. The exact identification of the services, systems and categories of data affected, without publishing information that could compromise citizens’ security;
2. Informing the affected persons, under the conditions of Art. 34 of Law No. 195/2024, and a secure mechanism through which every citizen can check the status of their data;
3. The results of the security audit and an explanation of the vulnerabilities that allowed the data to be extracted, within limits that do not affect the investigation;
4. Establishing institutional responsibility and, if attributable acts are confirmed, the liability of the persons involved;
5. Measures to prevent similar incidents and to support the persons harmed.

Conclusion

When the state asks for personal data, it asks for trust. And when that data leaves the control of the institutions, the state has a duty to explain, to remedy and to respect the rights of those affected.

“Accountability cannot be replaced by a press release. Transparency cannot be replaced by promises. Citizens’ vigilance is necessary, but the obligations of institutions remain obligations.”

MP Alexandru Verșinin’s team will continue to demand transparency and accountability until the authorities present clear conclusions.

Are you among the affected persons, or do you need help filling in the form? Write to us: contact@pda.md.