PERSONAL DATA · MOLDOVA
Around 750,000 IDNPs affected: how to check access to your data
Published by Avocat Expert · Republic of Moldova
Found an unfamiliar entry in your data-access history? Learn what to check, what records to keep and how to request an official explanation.
What the authorities reported
AGE preliminarily estimates that data relating to around 750,000 IDNPs were extracted on 19–23 October 2026. The same data categories were not exposed for everyone. The investigation continues. AGE announcement of 27 October 2026 (Romanian).
1. Check EVO
- Open the official EVO app and authenticate normally.
- Open “Cont” / “Contul tău” and look for “Istoricul accesării datelor”. Labels may vary by app version.
- Review entries for 19–23 October 2026 and surrounding dates.
- Record the institution, date, time, service and stated basis where available.
AGE describes access history within the EVO 2.0 account area. Start from the official EVO portal, rather than an unsolicited link. Official EVO account guidance (Romanian).
2. Check MCabinet
Open MCabinet.gov.md and sign in. Find “Istoricul accesării datelor personale”, select the relevant period and review available entries. AGE description of the MCabinet service (Romanian).
If the service is unavailable, record when you tried and return later. An outage alone does not indicate whether your data were affected.
3. Understand the limits of the history
An entry may relate to a service you requested. An unfamiliar entry warrants clarification; it does not automatically establish that the named institution or a particular employee stole data.
AGE also reported incorrect logging of the basis for some accesses. AGE technical clarification. The displayed description therefore needs to be considered alongside the institution’s response and technical findings.
No suspicious entry does not prove that you were unaffected. Visible logs and confirmation of extraction are different. As of this article’s review, we did not identify a comprehensive public, official checker confirming every individual case in this incident.
4. Request an official explanation
Contact the institution shown in the entry or the service’s data controller through a verified official channel. If responsibility is unclear, ask AGE which institution to contact. Keep delivery evidence and the registration number.
Ask about processing, the access observed and whether your data were included in the incident, insofar as this has been established. Law No. 195/2024 provides a right of access. CNPDCP explanation of data-subject rights (Romanian).
Suggested request wording
To [responsible institution / controller]
My data-access history shows an entry dated [date and time], for [service / stated basis], which I do not recognise.
Please investigate and explain whether and why my data were processed, the relevant categories, legal basis and recipients or categories of recipients, as provided by law. Please clarify whether my data have been established as part of the October 2026 incident and what measures you recommend.
I attach [record of the entry]. Please advise how I can confirm my identity securely and provide a registration number.
Adapt the wording to the facts and institutional requirements, including any language requirements. Share only necessary information through a verified channel. This example is not submitted from our website.
5. Keep evidence privately
Save screenshots or exports, when you noticed the entries and the institution’s replies. Preserve suspicious messages, caller details and transaction records where relevant.
Do not post your IDNP, identity document, family details or banking information publicly. Agree a suitable channel before sharing documents for legal advice.
6. Complaints and suspected fraud
Consider a complaint to CNPDCP if you suspect a breach. Prepare the facts, institution, evidence and previous correspondence. Check the formal and signature requirements on CNPDCP’s official complaints page (Romanian); an informal message is not necessarily a complete complaint.
For suspected fraud, identity misuse or unrecognised transactions, contact the bank and Police through official channels as appropriate. A data-protection complaint and a criminal report serve different purposes. Compensation requires assessment of the facts and evidence and is not automatic.
7. Avoid follow-up scams
Do not submit an IDNP or card details to pages offering to “check the 750,000-person list”. Never disclose passwords, PINs or confirmation codes. Knowing your name or IDNP does not prove a caller’s official identity. Authorities’ advice of 24 October.
If you already shared codes or approved a suspicious operation, contact the bank or affected account provider immediately through its official channels. Changing a password may protect that account; it does not retrieve information already extracted elsewhere.
Related guides
Official sources (Romanian)
Information prepared on 29 October 2026. The incident is developing and official findings may change. This article does not collect IDNPs or check whether individuals were affected.