Moldova's Electronic Governance Agency says that between Oct 19 and 23 about one million personal ID numbers (IDNPs) were queried, and data sets for about 750,000 were extracted before the activity was stopped at 11:30 on Oct 23. The attackers exploited services that did not require authentication, then used what they got to pull more from linked systems. One service logged the legal basis for lookups wrongly, which is why citizens saw odd entries in the EVO app's access history.

• Data: name, birth date and place, close family members, insurance status, family doctor, social benefits, pensions, disability, driver's licence, photo, vehicles and companies, plus IBAN, tax debts and MPay payment history. Not everyone had every category exposed; card data was not affected and no registry records were changed.
• Response: 82 digital services were checked and more than 30 information systems and admin panels taken offline; new attempts on Oct 25 and Oct 27 failed. Prime Minister Vasile Tofan said on Oct 28 that authorities are looking at possible involvement of foreign state actors.

Take: this is a textbook case of chained data-lookup APIs. Any government or enterprise portal that returns personal data by ID number should require authentication, rate-limit per caller and alert on bulk enumeration.