{"schema_version":"0.9.0","id":"LR-2026-0256","record_version":2,"title":"Warp cloud platform breached by swarm of AI agents via infrastructure supplier","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-10-23","date_disclosed":"2026-10-28","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"human_review","summary":"Hackers breached Moldovan government systems, exploiting unauthenticated vulnerabilities in an exposed logging service, and stole sensitive data on about 750,000 citizens. Government IT staff spotted the extraction on October 23; officials shut down 82 public digital services and 30 government networks, and services are being restored after security audits.","tags":[],"date_detected":null,"near_miss":false,"root_cause":"infrastructure","root_cause_detail":"a source states a shared system or channel was the path","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":"82 public digital services and 30 government networks shut down","remediation":"Services restored after being cleared in a security audit","precursor_events":"hackers also breached its healthcare database in April"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":750000,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Data on roughly 750,000 citizens, about a third of the population, was stolen in a live government compromise.","harm_class":["privacy","third_party_security"],"affected_description":"750,000 citizens, roughly a third of the country's total population of 2.35 million","protected_class_involved":null,"data_categories_exposed":["pii","financial"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://news.risky.biz/risky-bulletin-moldova-takes-down-80-public-services-after-cyberattack/","publisher":"Risky Business Newsletters","date":"2026-10-28","type":"press","title":"Moldova takes down 80+ public services after cyberattack","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_occurred":"C","event.near_miss":"D","event.root_cause":"D","event.adversarial_actor":"C","event.operations_paused":"C","event.remediation":"C","event.precursor_events":"C","event.agent_involved":"D","event.detection_method":"C","event.incident_class":"C","event.summary":"C","event.date_disclosed":"A","event.trigger":"D","impact.records_exposed":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"C","event.root_cause_detail":"D","impact.severity_because":"D"},"field_citations":{"event.date_occurred":[{"source_index":0,"quote":"The incident took place last week, on Friday, October 23, when the government's IT staff spotted hackers extracting data from their network."}],"event.detection_method":[{"source_index":0,"quote":"The incident took place last week, on Friday, October 23, when the government's IT staff spotted hackers extracting data from their network."}],"event.root_cause":[{"source_index":0,"quote":"The hackers got in by exploiting vulnerabilities in a logging service left exposed online without authentication."}],"event.adversarial_actor":[{"source_index":0,"quote":"The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country's population."}],"event.incident_class":[{"source_index":0,"quote":"The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country's population."}],"event.agent_involved":[{"source_index":0,"quote":"The hackers got in by exploiting vulnerabilities in a logging service left exposed online without authentication."}],"event.near_miss":[{"source_index":0,"quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million."}],"event.operations_paused":[{"source_index":0,"quote":"Officials shut down 82 public digital services and 30 government networks to contain the incident and prevent additional data exfiltration."}],"event.remediation":[{"source_index":0,"quote":"The e-gov agency has been slowly restoring services over the past days, once they've been cleared in a security audit."}],"event.precursor_events":[{"source_index":0,"quote":"This is the second major hack that has hit the small Eastern European country this year after hackers also breached its healthcare database in April."}],"event.summary":[{"source_index":0,"quote":"The hackers got in by exploiting vulnerabilities in a logging service left exposed online without authentication."}],"impact.records_exposed":[{"source_index":0,"quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million."}],"impact.harm_class":[{"source_index":0,"quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million."}],"impact.affected_description":[{"source_index":0,"quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"financial details, such as bank accounts, debt, and MPay history"}],"impact.severity_because":[{"source_index":0,"quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million."}],"context.country":[{"source_index":0,"quote":"The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country's population."}],"context.industry":[{"source_index":0,"quote":"Officials shut down 82 public digital services and 30 government networks to contain the incident and prevent additional data exfiltration."}],"impact.severity":[{"source_index":0,"quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"Only one source (Risky Business Newsletters) is present, and its content describes a Moldovan government data breach by human hackers, not the AI-agent incident named in the case title; no source describes AI agents, a model, harness, tools, permissions, autonomy, guardrails, deployment context, or a Warp cloud platform. system.* fields are therefore omitted. event.trigger omitted: no source states a cause in trigger terms. event.failure_class omitted: no autonomous agent involved. event.date_disclosed not written (derived). event.duration, time_to_contain, date_detected not written in fields; no timeline items bound them. impact.direct_loss_usd, remediation_hours, third_parties_affected_count, loss_range_usd, reversibility, downstream_exposure_count null: not stated. context.org_size_band, denominator, systemic_exposure, shared_model_id, upstream_incident_id, incident_evidence, regulatory, coverage null: not stated. event.responsible_party, input_provenance, control_failure, secondary_failure_classes, failure_class_detail, tags left empty: not stated. Judgements: root_cause=infrastructure from the exposed logging service as the path; incident_class=security_compromise from attacker breach; agent_involved=false and near_miss=false classified from behaviour; industry classified as Public Administration. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.near_miss: classified from described behaviour. event.agent_involved: classified from described behaviour. event.trigger: no source states a cause. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident."},"context":{"industry":"Public Administration","org_size_band":null,"country":"MD","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Moldova's government ran public digital services and government networks. Hackers exploited vulnerabilities in an exposed, unauthenticated logging service to reach government systems.","quote":"The hackers got in by exploiting vulnerabilities in a logging service left exposed online without authentication.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Hackers breached government systems and extracted sensitive citizen data, crossing the boundary of government network security.","quote":"The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country's population.","source_index":0,"grade":"C"},{"step":"reached","text":"Data on about 750,000 citizens, roughly a third of the population, including financial details such as bank accounts, debt and MPay history.","quote":"According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million.","source_index":0,"grade":"C"},{"step":"caught","text":"Government IT staff spotted the hackers extracting data from the network on Friday, October 23.","quote":"The incident took place last week, on Friday, October 23, when the government's IT staff spotted hackers extracting data from their network.","source_index":0,"grade":"C"},{"step":"done","text":"Officials shut down 82 public digital services and 30 government networks to stop further exfiltration; law enforcement was called to investigate, and services are being restored after security audits.","quote":"Officials shut down 82 public digital services and 30 government networks to contain the incident and prevent additional data exfiltration.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://news.risky.biz/risky-bulletin-moldova-takes-down-80-public-services-after-cyberattack/"]}}