Audit Finds Cybersecurity Risks in Moldova’s Government MCloud Platform

Vulnerabilities in the government cloud: how our data might have been leaked

The Audit Chamber has identified cybersecurity risks and a low level of data protection on the MCloud government cloud platform. The government cloud requires an urgent update to its cybersecurity rules and regular testing of systems to prepare for major disruptions or cyber-attacks. The Audit Chamber reached this conclusion following its audit, noting that, due to poor coordination between departments and the fragmented nature of the infrastructure, the platform’s potential is not being utilised to the full.

Add Logos Press as a preferred source on Google

The auditors identified the need to update information security regulations as the main problem in the area of data protection. Furthermore, the audit revealed that the mechanisms for ensuring business continuity and data recovery in the event of serious incidents are not being properly tested.

The situation regarding security and governance is exacerbated by the fragmentation of the state’s digital ecosystem and an imbalance of powers. Of the 407 state information systems due to be migrated to a single secure platform, 148 (or 36.4 per cent) continue to operate outside it.

Against the backdrop of the recent theft of personal data, the governance gap raises significant concerns for the auditors. There is no clear division of responsibilities between the e-Government Agency and the Information Technology and Cybersecurity Service (STISC). This not only hinders the development of the cloud platform but also prevents the formation of a unified strategic vision and a unified system for security and data storage.

For instance, the existence of parallel servers – with 27 state organisations continuing to use their own server infrastructure and data storage equipment – hinders the consolidation of resources and unified security control. In 2025, maintaining such fragmented capacities cost the state budget an additional 79.4 million lei.

There are also so-called ‘blind spots’ in monitoring within the government cloud. The platform lacks a fully-fledged mechanism for tracking the actual consumption of IT resources, making it impossible to objectively assess the load on the infrastructure and justify the need for its expansion.

Although the Court of Auditors has recognised MCloud as a strategically important initiative for modernising the country’s IT infrastructure, progress in addressing the identified shortcomings has been extremely slow. According to figures released by the agency, the overall rate of implementation of the auditors’ recommendations stands at just 12 per cent – to date, only three recommendations have been implemented, and even those only partially.

This story was translated with the assistance of artificial intelligence.The translation was also reviewed by the Logos Press editorial team.

How did this story make you feel?