The cyberattack and data linked to 750,000 IDNPs: can loans be taken out in the names of those affected?

Legal analysis | 30 October 2026

The unauthorised extraction of personal information from public systems raises questions that go beyond IT security: how can identity fraud be prevented, what happens if someone tries to conclude a contract in another person’s name, and under what conditions must citizens be informed?

What the authorities have confirmed

According to the statement issued by the Electronic Governance Agency (AGE) on 27 October 2026 ^[1], approximately one million IDNPs (state personal identification numbers) were queried between 19 and 23 October and, according to preliminary estimates, data sets linked to around 750,000 IDNPs were extracted without authorisation. This does not mean that all possible information was exposed for each IDNP. The categories mentioned by AGE include identification data, family information, health insurance, pensions and social benefits, photographs, assets and companies, IBAN codes, tax debts and the history of payments made through MPay, the government payment service.

The agency announced that the extraction was halted on 23 October, that 82 digital services were checked and that preventive disconnection measures were taken. AGE also stated that bank card data were not affected, that merely knowing an IBAN does not allow transfers from an account, and that the investigations have not identified any unauthorised changes to state registers. These clarifications are important, but they do not remove the risk of identification data being used fraudulently.

On 30 October, media in the Republic of Moldova reported that the Chișinău Municipal Prosecutor’s Office had opened a criminal investigation in connection with the incident. The investigation and the assessment of the extent of the damage are ongoing.

Confirmation from the supervisory authority: The National Center for Personal Data Protection stated that AGE had notified it of the incident. The Center specifies that the estimates are preliminary, that the exposed information may give rise to fraud risks and that persons who believe they have been affected may ask the relevant data controller for clarification. ^[2]

The key question: can other people’s electronic signatures be used?

As of the date of this analysis, the public sources consulted contain no confirmation that the attackers obtained private keys, PIN codes or control over the devices and mechanisms needed to apply electronic signatures. Consequently, the extraction of a name, an IDNP or even a photograph does not prove that anyone can sign electronically in the holder’s place. ^[4]

A distinction must be drawn between identity data and the means of signing. In the Republic of Moldova, a qualified electronic signature can be used through an identity card with an electronic function, a USB token-type cryptographic device or mobile signature services, subject to the conditions of the mechanism concerned. Legitimate use involves technical and authentication controls; knowing someone’s IDNP is no substitute for the private key or the required authorisation.

Under Article 21(2) of Law No. 124/2022 ^[8], a qualified electronic signature has the same legal value as a handwritten signature. That is precisely why, where there is a specific suspicion of unauthorised use, the following become relevant: validation of the certificate, the authentication history, identification of the device or method used, the date of the operation and verification of the person’s actual consent.

On 28 October 2026, AGE announced that it had temporarily disabled two-step authentication and EVOSign authentication in MPass, the government sign-in service ^[3], as a preventive measure. This decision should not be mistaken for evidence that qualified electronic signatures have been compromised.

The risk of fraudulently obtained loans and credit

Even without access to a qualified electronic signature, unlawfully obtained personal data can be used for identity theft attempts, credit applications under a false identity, phone scams or compromising remote verification steps. The National Commission for Financial Markets expressly warns that personal data and documents exposed online can be used in credit fraud. ^[5]

This risk does not mean that a loan has already been taken out in the name of a person whose IDNP is among those affected, nor that any lender would accept an application on the basis of an IDNP alone. Whether a contract is actually concluded depends on the identification, authentication and consent-verification procedures applied by the lender; the existence of fraud must be proven in each case.

If a credit agreement appears in the name of a person who did not apply for it, legal questions arise concerning the existence and expression of consent, the authenticity of the signature, the lender’s compliance with its identification obligations, the burden of proof and any harm suffered. The mere presence of a name or an IDNP in a document cannot replace an analysis of these elements.

Who must inform the people affected?

Law No. 195/2024 on personal data protection ^[7], in force since 23 August 2026, provides in Article 34(1) that the controller must inform the data subject without undue delay where a personal data breach is likely to result in a high risk to their rights and freedoms. The information must be clearly worded and explain the nature of the incident, its likely consequences, the relevant contact point and the measures taken or recommended.

However, Article 34(3) provides for exceptions: for example, where the data were protected by measures that rendered them unintelligible, where the high risk is no longer likely to materialise, or where informing each person individually would involve disproportionate effort. In the latter case, the law allows a public communication or a similar measure that is equally effective. Therefore, not every press release is sufficient ^[6], but nor can it be argued, without assessing the specific conditions, that individual notification is absolutely mandatory for each of the 750,000 IDNPs.

The obligation lies with the relevant controller or controllers, who must be identified according to the systems and processing operations affected. AGE has announced that the people affected will be informed. It remains essential that citizens can find out, through secure channels, whether any of their data were exposed and, if so, which categories, and what protective measures are recommended.

What every citizen can do

• Do not disclose PIN codes, passwords, one-time codes or electronic signature codes, and do not confirm operations requested through unexpected calls or messages.
• Verify any suspicious notification directly with your bank or the institution it claims to come from, using only official contact details. ^[9]
• Check your credit history regularly with the credit bureaus and immediately challenge any entries you do not recognise. The law allows you to request a free report once a year from each bureau that holds your credit history.
• If you suspect that your device, private key or signature codes have been compromised, contact your signature service provider immediately to have the certificate suspended or revoked, as appropriate. The mere appearance of your IDNP in the incident does not, in itself, prove that your certificate has been compromised.
• If an unknown loan or contract appears, challenge it in writing with the lender without delay, request a copy of the contract and the evidence of identification and signing, keep all evidence, report the matter to the Police and, with legal assistance, assess the available civil-law and data-protection remedies.

Conclusion

A security breach should not be assessed solely by the number of records extracted. The legal issue is whether the information can be used to create the appearance of consent that never existed: a wrongly attributed electronic signature, a loan application, a financial obligation or another act concluded in a person’s name without their knowledge.

For now, there is no basis for asserting that the attackers can use the holders’ electronic signatures; there are, however, serious reasons to call for transparent checks on this possibility and for measures to prevent identity fraud. Protecting citizens requires not only secure systems but also effective information, robust authentication procedures and accessible legal remedies.

Informational material and legal analysis, prepared on the basis of public information available on 30 October 2026. It does not attribute definitively established legal liability to any person or institution and is no substitute for an assessment of each specific case.

The Law Office “MARCO DUMITRU” — Legal assistance and mediation in the Republic of Moldova. For a specific situation, please use the Contact page on this website.

Official sources and legal bases

The sources below come from public institutions of the Republic of Moldova or from the official legislation database. They are listed separately from the author’s legal interpretations. Accessed on 30 October 2026.

1. Electronic Governance Agency (AGE), 27.10.2026 — Statement on the incident: approximately 750,000 IDNPs, data categories and measures (in Romanian).
2. National Center for Personal Data Protection — Preliminary information and recommendations for citizens regarding the incident (in Romanian).
3. Electronic Governance Agency (AGE), 28.10.2026 — Temporary deactivation of two-step authentication and EVOSign in MPass (in Romanian).
4. Public Services Agency (PSA) — Identity card: qualified certificate, electronic functionality and conditions of issue (in Romanian).
5. National Commission for Financial Markets (NCFM) — Warnings: “Credit fraud – who is using your identity?” (in Romanian).
6. National Center for Personal Data Protection — Data security: notification and information obligations (in Romanian).
7. Law No. 195 of 25.07.2024 on personal data protection, Articles 33–34 — official text, legis.md (PDF, in Romanian).
8. Law No. 124 of 19.05.2022 on electronic identification and trust services, Article 21(2) — official text, legis.md (PDF, in Romanian).
9. National Bank of Moldova, 14.05.2026 — Warning about fraud attempts involving misuse of the institution’s identity (in Romanian).

Press report, used solely for the information on the opening of the criminal investigation: MOLDPRES, 30 October 2026 (in Romanian). It is not an official statement by the Prosecutor’s Office.

Note: the figures and technical findings are preliminary. The public sources cited do not confirm that private keys, PIN codes or electronic signature devices were compromised, nor that any loans were fraudulently taken out as a result of this incident.