Cyberattack on Moldova's National Health Insurance Company may have exposed a third of its database

At the end of April 2026, Moldova's National Health Insurance Company (CNAM) confirmed that it had been hit by a cyberattack several weeks earlier that may have led to the exfiltration of data. CNAM's database holds personal information and payment records for everyone covered by Moldova's national health insurance scheme, as well as financial details of private medical service providers, and acts as a central platform connecting regional and national hospitals.

Ion Vintilă, deputy director of Moldova's cybersecurity agency, told local media that about one third of CNAM's database may have been affected. CNAM said the affected system had been secured quickly, that the integrity of the database remained intact and that the incident had not disrupted hospitals or other medical institutions relying on the insurance system. Technical assessments pointed to the possible theft of limited information.

Suspected state motive

No ransom demand was received. Vintilă said no messages had been sent asking for money or offering data recovery, suggesting the goal was access to citizens' private information rather than financial gain, and described the operation as meticulously planned. Officials said they were considering external involvement, including possible links to actors from Russia, but no formal attribution was published.

Why it matters

Moldova, an EU candidate country, has faced repeated cyberattacks, disinformation and hybrid pressure attributed to Russia as it moves toward European integration. A breach of a national health insurance database gives an attacker identity, health and payment data on a large share of the population, which can be used for intelligence, influence operations or fraud long after the systems are restored.