On July 14, 2026, Romania's National Agency for Cadastre and Real Estate Advertising (ANCPI) lost its entire digital land registry estate to a cyberattack that, according to the attacker, destroyed production systems and backups after an extortion demand was refused. The e-Terra cadastral platform, the RENNS system, institutional email, and the public-facing apps used by notaries, lawyers, banks, and citizens all went dark, freezing property transactions nationwide for roughly a week. ANCPI initially described the outage as a "technical incident," then as "the most serious technical incident in the institution's history," before confirming a cyberattack. A threat actor using the alias ByteToBreach listed stolen ANCPI data for sale on a hacking forum one day later, on July 15. Crucially, the agency's own position and the attacker's claims do not agree on the central question of whether the core records were destroyed, and that disagreement is still unresolved in the public record.
What Happened
The timeline is consistent across sources. On Tuesday, July 14, e-Terra became unavailable to users. Risky Business, citing unnamed sources, reported that an intruder logged in with valid credentials, mapped internal systems, attempted to extort the agency, and, after the extortion failed, wiped systems and backups. Help Net Security confirmed the outage on July 16 and noted the agency's early framing of a "major technical incident." heise online, summarizing the Risky Business reporting, adds that the attacker claimed in dark web posts to have manipulated backup copies specifically to prevent recovery. The ctipilot.ch entry for July 19 cites a screenshot published by the attacker in which he states he began deleting the available backups.
By July 20, ANCPI had publicly stated, following what it described as completed security verification, that its technical and legal databases had not been affected. The Record reported the same agency line: the core records containing cadastral information such as property boundaries and maps, plus legal information including ownership and mortgages, were not compromised. ANCPI framed the extended outage as deliberate protective isolation rather than destruction, and said it had begun migrating applications to the Romanian Government Cloud under the coordination of the Special Telecommunications Service (STS), a process expected to complete on July 22 ahead of phased, verified restoration. Risky Business separately restored the agency's website timeline, noting officials announced they were rebuilding the entire network from scratch.
No source in this set provides a record count for the affected registry, and none should be inferred. The concrete figures that do exist are financial: Romania Insider, citing Ziarul Financiar, reports ANCPI spent RON 710 million (EUR 135 million) on digitalization over 20 years, of which only 0.2%, some RON 1.6 million (EUR 305,000), went to cybersecurity.
Where the Accounts Conflict
This is the part defenders should not gloss over. There are two irreconcilable public accounts of the impact.
The attacker's account, relayed by Risky Business and echoed by heise online, Cybernews, and the ctipilot.ch briefs, is that production systems and backups were both wiped and that backup copies were manipulated to block recovery. The agency's account, issued July 20 and reported by The Record, Romania Insider, and Digi24, is that the technical and legal databases were not affected.
Weighting matters here. ANCPI's statement is the victim's own primary attestation and outranks the attacker's self-serving forum claims. But the agency also spent the first days of the incident calling a wiper attack a technical problem, which is a reason for caution rather than dismissal. Risky Business offers the reconciling hypothesis: the hacker may well have deleted the backups he could see, while the agency held an offline copy he could not reach, "otherwise things would have gotten really messy over the coming months in Romania." Eon's analysis, an OTHER-tier vendor blog, states this more confidently as fact, asserting the records survived because ANCPI kept a copy the attacker could not reach. That specific causal claim is analysis, not confirmed reporting, and should be treated as the most plausible reading rather than an established one. Note also that "databases not affected" and "backups were deleted" are not strictly contradictory statements; both can be true at once. No source has closed that gap.
What Was Taken
Separate from destruction, exfiltration appears well supported. On July 15, data attributed to ANCPI was offered for sale on a known hacking forum. Across Risky Business, heise online, and Help Net Security, the advertised material includes:
- Employee credentials and access data
- Internal agency documents
- Details of ANCPI's internal IT network architecture
- Various ANCPI databases, claimed to contain data on Romanian citizens
- A copied GitLab server carrying the source code for the e-Terra and RENNS applications
The actor also claimed to have deployed a ransomware variant. Source-code theft for the national cadastre platform is the quietest and most durable item on that list: it hands the actor, and anyone who buys from him, a permanent map for finding vulnerabilities in the rebuilt system. ANCPI's public line that administered data "has not been compromised" sits awkwardly against the forum listing and has not been reconciled.
Why It Matters
A land registry is a single point of failure for an entire economy. With e-Terra down, no land registry extract could be issued, meaning notaries could not certify transactions and citizens could not prove ownership. Romania Insider notes the timing amplified the damage: VAT on new homes rose from 9% to 21% on August 1, so an unusually large volume of transactions was queued to close in exactly the window the system was offline.
Eon's brief places Romania alongside Poland, Slovakia, Greece, Morocco, Russia, and Ukraine as land registries hit in the past three years. That is a pattern worth taking seriously even from an OTHER-tier source, because the logic is obvious: registries combine irreplaceable authoritative records, high public visibility, and, frequently, the funding profile the Romanian numbers illustrate.
The core lesson is about the recovery layer as a primary target. Backup destruction here was not collateral damage from an indiscriminate wiper; the attacker described going after backups deliberately to remove the victim's leverage in negotiation. Any backup that can be authenticated to with credentials an intruder already holds is part of the production trust boundary, immutability settings notwithstanding, because those settings are usually administered from the same identity plane.
The Attack Technique
Initial access is attributed to valid credentials. Dan Cimpean, director of Romania's National Directorate for Cyber Security (DNSC), told G4Media that the attack appeared to be financially motivated and was carried out by exploiting known software vulnerabilities that authorities had recently warned organizations to patch, combined with previously leaked credentials. That is the most authoritative technical account available, coming from the national cyber authority, and it is consistent with the credential-based entry described by Risky Business.
The attacker is tracked as ByteToBreach. KELA, which has profiled the actor since December 2025, assesses him as likely a single operator based in Oran, Algeria, active since June 2025 across forums, Dread, Telegram, and a dedicated storefront, with victims spanning government, banking, airline, and university targets in multiple countries, including a bank in Poland that acknowledged its breach. KELA documents the actor's tradecraft as exploiting known vulnerabilities in cloud and corporate infrastructure, reusing credentials harvested from infostealers and phishing, and at times brute force. Risky Business reports that KELA updated its profile after the ANCPI hack to name the operator as Zakaria Mahdjoub; that attribution is KELA's, relayed by a single outlet, and should be carried as such. Risky Business also links ByteToBreach to a breach of Sweden's e-government portal earlier this year.
The kill chain, as reported, is unglamorous and entirely repeatable: leaked or stolen credentials plus unpatched known vulnerabilities, then internal reconnaissance, then exfiltration, then extortion, then destruction of both production and recovery layers when extortion fails.
What Organizations Should Do
- Put backups outside the production trust boundary. The controlling question is not whether backups are immutable but whether the credentials an attacker steals from your environment can reach, alter, or delete them. Separate identity providers, separate accounts or tenants, and at least one genuinely offline or logically air-gapped copy. Romania's outcome, whatever the final forensic account, hinged on this.
- Patch against the actor's actual entry vector. DNSC says the attack exploited known vulnerabilities that authorities had already warned about. Treat national CERT advisories as operational tasking with deadlines, not as newsletters.
- Assume credentials are already leaked and hunt for them. Infostealer-harvested credentials are this actor's documented staple. Monitor stealer log feeds for your domains, enforce phishing-resistant MFA on every remote-access and admin path, and check that MFA cannot be bypassed on backup consoles and service accounts.
- Detect the reconnaissance phase. The attacker mapped internal systems before acting. Alert on anomalous internal enumeration, first-time administrative access from valid accounts, and, above all, on backup deletion, retention-policy changes, and snapshot removal, which should be treated as tier-one incidents.
- Protect source-code repositories as crown jewels. A copied GitLab server reportedly gave the actor the source for the national cadastre platform. Repositories holding the code for critical systems need the same segmentation, access review, and egress monitoring as the production databases they describe.
- Rehearse the manual fallback. Adrian Vascu of Veridio, quoted by Help Net Security, made the point cleanly: digitalization creates dependency fast, and continuity or an alternative is mandatory. For any service the public cannot do without, document and test the offline process for issuing what the digital system issues.
- Fix the budget ratio. A cybersecurity allocation of 0.2% of digitalization spend, as reported for ANCPI, is a governance finding, not an IT one. Boards and oversight bodies should be asked for that ratio explicitly.
Sources: The Attacker's First Target Was the Backups: Inside Romania's Land... | Romania: Cybercriminal deletes country's entire land registry datab... | Romania's land registry hit by cyber attack, data allegedly ... | Romania races to restore land registry after cyberattack ... | Hacker wipes Romania's entire land registry database | ANCPI (Romania cadastre): agency says core databases were NOT compr... | Romania's national cadastre agency ANCPI hit by a multi-day cyberat... | Romania’s real estate market still reeling from major cyberattack a...