Moldova Gives Prime Minister One Month to Propose Cybersecurity Reforms

Moldova will establish a working group led by Prime Minister Vasile Tofan to propose changes to government cybersecurity within one month, President Maia Sandu announced after a National Security Council meeting on November 6. The council plans to meet again in three months to assess progress. The announcement sets deadlines for proposals and review; it does not mean the reforms have already been enacted.

The decision follows a cyberattack on government information systems between October 19 and 23. Moldova's Electronic Governance Agency (AGE) has said that some public digital services were suspended for security checks while investigators examined attempts to extract personal data. Criminal proceedings have been initiated, according to the state news agency Moldpres, but the public reports reviewed do not identify a perpetrator or establish the full extent of any confirmed disclosure.

In its account of Sandu's remarks, Moldpres reported that the working group would assess existing vulnerabilities and submit proposals to strengthen state systems. The next National Security Council session is expected in about three months, creating a second public checkpoint for what the government has actually implemented.

Local publication Logos Press separately reported that the president identified system modernisation, clearer institutional responsibilities, regular security testing and monitoring as priorities. It also reported her call to review information-technology procurement rules and the responsibilities of contractors that build state systems. Those are proposed directions, not an enacted procurement law or evidence that a particular supplier caused the attack.

The latest directly accessible AGE bulletin, dated November 5, says 68 of 82 digital public services suspended for additional security checks had been restored. Fourteen remained unavailable at that point. AGE said its investigation and monitoring continued; its restoration figure should not be taken as proof that the incident's cause, affected population or data exposure had been fully established.

The council decision adds a governance response to TFNOS's earlier report on the restoration of seven more digital services. The earlier article concerned service availability; this follow-up concerns who must propose structural reforms and when officials say they will review results.

The next questions are whether the working group publishes a written mandate, which agencies and vendors it examines, whether it releases the one-month recommendations, and what legally binding measures or budget changes follow. TFNOS will also track AGE's service-restoration updates and any official findings on the data incident. None of the reviewed sources establishes a final forensic attribution or proves misconduct by a named contractor.