Moldova Loses Data on 750,000 Citizens and Belgium's Tax Portal Goes Dark: A Week of Attacks on European Public Services

Two European governments spent the last week of October rebuilding citizen-facing services after intrusions, and the contrast between them is the story. In Moldova, attackers spent five days querying the state's digital services and walked away with personal data on roughly 750,000 people, about a quarter of the population. In Belgium, an intruder got into the Federal Public Service Finance overnight, was spotted within hours, and the country's main tax portal was taken offline days before a filing deadline so that nothing could be taken. One country is now notifying its citizens. The other has extended a tax deadline.

Both incidents land in the same month that Belgian, Dutch and Finnish government sites were taken offline as a precaution over the PHP2Shell vulnerabilities, and as Moldova's prime minister told his cabinet there were signs of a broader campaign involving foreign state actors. For UK public bodies, councils, NHS organisations and the suppliers who build their citizen services, this is a week to read closely.

What Happened

Moldova: five days of extraction through unauthenticated services

Moldova's E-Government Agency (AGE) first announced an attack on 24 October. Its preliminary findings, published on 27 October, set out the mechanics. Between 19 and 23 October about one million national personal identification numbers (IDNPs) were queried against state services in an attempt to pull personal data without authorisation, and the agency estimates that full data sets were extracted for about 750,000 of them. The attackers "exploited vulnerabilities in services that could be accessed without authentication", the agency says, then used what they obtained to make further extractions. One e-service also logged the legal basis for its data processing incorrectly, which is why some citizens later saw unexplained entries in the access history shown by the EVO government app.

The data at risk is unusually complete. Depending on the person it can include identity details and date and place of birth, information on close family members, health insurance status and family doctor, social benefits, pension and disability status, driving licence details and photograph, vehicles and companies owned or managed, and financial information including IBANs, tax debts and MPay payment history. AGE says not every affected person had every category exposed, that bank card data was never involved because card payments are processed by the banks, and that investigators found no unauthorised changes to state registers.

The extraction was stopped at 11:30 on 23 October. The same day 82 public services and more than 30 information systems and administrative panels were disconnected and the institutions responsible for them were given technical recommendations. A further forced-access attempt on several services was blocked at around 02:00 on 25 October, and new extraction attempts at about 07:00 on 27 October all failed. Most of the affected services have since been fixed and are being brought back as their security is reconfirmed, with a wider review of government systems under way.

Mihai Lupascu, head of Moldova's national cyber security agency, told RFE/RL it was the largest cyber attack the country has recorded, "highly sophisticated and well-prepared" and delivered in several waves, and said AI was probably used, including to identify the vulnerabilities. Prime Minister Vasile Tofan told ministers there were indications of a broader campaign involving foreign state actors without naming any, and President Maia Sandu called a National Security Council meeting. Lupascu said attributing the attack to a particular actor would be premature.

Belgium: an intrusion caught in hours, a portal rebuilt in days

Belgium's story began overnight on Tuesday 27 to Wednesday 28 October, when attackers got into the network of the Federal Public Service Finance (FPS Finance). According to the federal government's update of 29 October, the service's security tools and monitoring detected the intrusion within a few hours. The attack "did not spread far enough to take control of applications or reach data", the suspect components were isolated from the rest of the network, and the government describes the attempt as stopped. "No data was disclosed," the statement says.

What citizens saw was MyMinfin, the main portal for managing tax affairs, disappearing on 28 October, three days before an income tax filing deadline for certain categories of taxpayer. Tax-on-Web and Biztax, the online filing services for individuals and companies, went with it. FPS Finance told The Record that other government applications remained fully or partially operational and that there was "no indication that a data breach has occurred", while investigators continued to check. Because the online services had to be rebuilt in an isolated environment, which the government said would take "considerable time", the filing deadline was moved from 31 October to 16 November. On the evening of Saturday 31 October FPS Finance announced that MyMinfin, Tax-on-Web and Biztax were back, and La Libre reported on 1 November that the service was again confirming that no data had been stolen and that attackers had taken control of no application.

The intrusion is being treated as a hacking offence, with the Federal Police and the Centre for Cybersecurity Belgium asked to identify the perpetrators. Earlier in October a security alert over the PHP2Shell flaws led Belgian authorities to take several government websites offline, FPS Finance sites among them; the Centre for Cybersecurity Belgium said it had received no reports of successful exploitation against Belgian sites, and the authorities have not publicly linked that episode to this one.

Who Is Affected

In Moldova the affected population is anyone whose IDNP was in the extracted set, which AGE says it will notify directly. The agency has already published fraud guidance: be suspicious of calls, texts and emails that use personal details, never share passwords or authentication codes, verify any request through official channels, and ignore alarming messages about family members until they are checked by a known number. That last point reflects the data stolen. Someone who knows a person's family members, doctor, benefits, vehicle and tax position can write a very convincing message, and the agency is working with banks and telecoms operators to issue additional alerts.

In Belgium the affected group is taxpayers and accountants who lost a week of access to MyMinfin, Tax-on-Web and Biztax and now have until 16 November to file.

For UK organisations the relevance is indirect but real. Any council, NHS trust, arm's-length body or government supplier that runs a citizen-facing service exposing records by identifier has the Moldova problem in miniature. And any organisation that has invested in detection will recognise what Belgium did right. Cybergen's threat intelligence team has watched the same hybrid pressure build across the Nordics this autumn, with Norway raising its national cyber risk level to High on 28 October; the ENISA report that AGE cites counted about 2,600 incidents against public administration among the 8,200 it analysed.

Why It Matters

The Moldova breach is a textbook example of a failure mode that is far more common than zero-day exploitation: services that answer questions they should not. A lookup that takes an identifier and returns a record, with no login and no rate limit, is an export tool for anyone willing to iterate through a million numbers. The attackers did not need credentials, malware or a foothold on a server. They needed a list of identifiers and a few days. The agency's own account, that data from one service was then used to query others, describes an attacker stitching together a citizen's life one unauthenticated endpoint at a time.

The lesson is not unique to governments. Patient portals, customer account checkers, order-tracking pages, booking references, parcel lookups and partner APIs all make the same trade-off between convenience and exposure, and the people who build them rarely test what an unauthenticated user can enumerate at scale. The addition of AI tooling, which Moldova's officials believe was used to find the weak services, lowers the cost of that enumeration further.

Belgium illustrates the other half of the equation. FPS Finance will face hard questions about how an attacker got in at all, but its monitoring detected the intrusion within hours, the compromised components were isolated, and the decision to take the national tax portal offline before a deadline was made quickly and communicated clearly, with a new deadline announced rather than a vague promise. That is what an organisation with practised incident response looks like from the outside. The cost was a week of disruption and an extended deadline. The alternative, visible a few hundred miles east, was a national data loss that will feed fraud for years.

What To Do Now

Inventory every endpoint that returns personal data and test it unauthenticated. That includes legacy lookup services, mobile app back-ends and APIs built for partners. For each one, ask what it returns for a valid identifier, what it returns for an invalid one, and whether anything stops a client asking a million times. Fix broken object-level authorisation first, then add rate limiting and alerting on bulk patterns.

Make sure you would see an extraction in progress. Moldova's attackers queried a million identifiers over five days. Logging that captures volume per client, unusual sequences of identifiers and off-hours bursts, feeding a team that is actually watching, is what turns five days into five minutes. If your monitoring only covers servers and endpoints, your public services are a blind spot.

Decide in advance when you will pull a service offline. Belgium's rapid decision depended on someone having the authority and the confidence to switch off a national portal days before a deadline. Write that decision into your incident response plan, agree who can make it, and agree what you will tell users and regulators in the first hour. A tabletop exercise built on this week's two scenarios is a good way to test it.

Rebuild, do not just restore. FPS Finance rebuilt its online services in an isolated environment before reconnecting them, accepting several days of downtime to be sure nothing persisted. Restoring from backup onto the same compromised infrastructure is how organisations get hit twice.

Prepare your fraud response as well as your technical one. If personal data does leave, the harm arrives as phishing, vishing and impersonation aimed at the people in the records. Have the notification letters, the helpline script and the warnings to banks and partners drafted before you need them, and brief your own staff, who will be targeted with the same data.

How Cybergen Can Help

Cybergen's application security and CREST penetration testing services test citizen and customer-facing services for exactly the unauthenticated enumeration and access control weaknesses behind the Moldova extraction. Our 24/7/365 managed detection and response gives public bodies the hours-not-days detection Belgium relied on, and our incident response service and tabletop exercises help you rehearse the decision to take a service offline before you have to make it for real.

Frequently Asked Questions