On July 14, 2026, Romania's national land registry stopped working. The cadastre application known as e-Terra went offline along with internal email, and within days the country's real-estate market had frozen: notaries could not authenticate sales or register mortgages, and citizens could not pull proof of ownership. Romania's ANCPI Land Registry first described it as a technical incident. It was a cyberattack, confirmed by July 16 and characterized by Romania's National Cyber Security Directorate (DNSC) as "not complex" and preventable. There was no zero-day. The attacker relied on known unpatched vulnerabilities and leaked credentials, and, per leaked configuration data, walked into an environment carrying a Group Policy named "DISABLE WINDOWS FIREWALL."
What Happened
The intrusion took two public institutions offline in three days. On July 14, e-Terra and other ANCPI applications, including email, went dark, and the agency initially called it a major technical failure. On July 15, stolen ANCPI data was offered for sale on a hacking forum, a listing that threat-intel firm KELA flagged as a breach claim. On July 16 the event was confirmed as a cyberattack, and separately Romania's Ministry of Investments and European Projects (MIPE) confirmed one of its procurement applications had also been hit. By July 17, Romanian outlet Public Record was detailing the forum listing, and on July 20 ANCPI stated that, per verifications so far, its technical and legal databases were not affected.
The accounts diverge on damage. Sources cited by Risky Business reported that production systems and reachable backups were wiped. DNSC confirmed that some data was exfiltrated in limited volume. ANCPI maintained that its authoritative databases survived, and recovery reportedly depended on backups the agency had kept out of the attacker's reach. Taken together, the reporting points to known weaknesses, exposed credentials, and recovery systems the attacker could reportedly touch.
What Was Taken
DNSC confirmed exfiltration of a limited volume of data, including samples of user credentials and fragments of application code. The criminal forum listing went further, advertising claimed citizen data and a claimed copy of ANCPI's GitLab source code, as detailed by Public Record on July 17. ANCPI's position, stated on July 20, is that its authoritative technical and legal databases were not affected. The discrepancy between "authoritative databases intact" and "production systems and reachable backups wiped" is the central open question of this incident: the destructive impact appears real even where the crown-jewel records were preserved on isolated backups.
Why It Matters
This was a national land registry, the system of record for property ownership across an entire country. When it froze, an entire real-estate market froze with it. That is the strategic lesson for defenders: the impact of a breach is not measured only in records stolen but in the essential civic functions that stop when a single authoritative system goes offline. The attack was ordinary in every technical respect, which makes it more alarming, not less. DNSC's own assessment that the intrusion was preventable, using vulnerabilities recently flagged to ANCPI and credentials already circulating online, is an indictment of basic hygiene at a critical-infrastructure operator. The near-simultaneous MIPE procurement compromise suggests government targets across Romania share the same exploitable weaknesses.
The Attack Technique
The attacker chained two commodity primitives: leaked credentials and known, unpatched vulnerabilities. Per DNSC, the vulnerabilities had been flagged to ANCPI recently and left unremediated, and the credentials had leaked and been posted online, so no bypass or novel exploit was required to gain access. Leaked configuration data revealed a Group Policy named "DISABLE WINDOWS FIREWALL," indicating host-based network defenses were administratively turned off across the environment, easing lateral movement. The reported wiping of production systems and reachable backups points to a destructive objective on top of exfiltration, with recovery only possible because some backups sat outside the attacker's reach.
What Organizations Should Do
- Treat leaked-credential monitoring as continuous, not incident-driven. Scan paste sites and criminal forums for your domains and rotate exposed credentials before they are weaponized; enforce phishing-resistant MFA on every externally reachable and privileged account.
- Close the patch gap on flagged vulnerabilities. When a national CERT or vendor flags a known CVE, treat it as an active exploitation warning and remediate on a clock measured in days, not quarters.
- Never disable host firewalls fleet-wide. Audit Group Policy and endpoint configuration for controls like "DISABLE WINDOWS FIREWALL" and restore host-based segmentation to slow lateral movement.
- Keep offline, immutable, and access-segregated backups. This incident was survivable only because some backups were out of the attacker's reach; assume reachable backups will be wiped and test restoration from isolated copies.
- Segment authoritative systems of record from general IT. Isolate the databases that keep a market or civic function running so that a foothold in email or a procurement app cannot cascade into the crown jewels.
- Rehearse the destructive-attack scenario. Plan and drill for a wiper event, not just data theft, including continuity of the public services that depend on the system.
Sources: How stolen credentials and known vulnerabilities brought Romania's land registry to a standstill