On 14 July 2026, Romania's (ANCPI) was hit by a cyberattack. The attack disrupted ANCPI's IT infrastructure, including its cadastre and land-registration systems. ANCPI applications, such as emails, and e-Terra, the cadastre application, were frozen, and the stolen information was put on sale on an undisclosed hacking forum.
This attack is considered to be "the most serious technical incident in the institution's history."
Attack After the attacker gained access using valid credentials, the e-Terra platform became unavailable, preventing employees from completing mortgage registrations, building-permit applications, and cadastral reception requests. The attacker demanded payment after gaining access to ANCPI's systems, but the agency refused. The attacker subsequently wiped the production systems and backups. Stolen data, including internal documents, employee credentials and source code, was then offered for sale on a hacking forum.
The attacker also posted a message on the forum mocking ANCPI: "Thy arss shall be spanked, Romania! [ANCPI]".
Although the hacker claimed to have deleted the backups, officials announced that the network was being rebuilt and that an offline copy appeared to have survived.
Aftermath The hacker group was identified to be ByteToBreach. In a later interview, the hacker who claimed responsibility for the attack apologized for the problems caused by the incident. He said that he had exploited a vulnerability known since 2021 and stated that the stolen data "wouldn't be sold to just anyone". He also denied that he had demanded a €10 million ransom, saying that such matters were discussed only between the relevant parties. The group has targeted organizations in numerous countries. The most targeted countries are the United States and India, followed by Italy, Spain and Russia. Other victims have been identified across Europe, including several CIS countries, as well as Asia, Africa and Latin America.
The leak revealed details of ANCPI's Active Directory environment, including the use of antiquated operating systems such as Windows XP, Windows 7 and Windows Server 2003. It also revealed at least 69 Group Policy Objects, including policies named "DISABLE WINDOWS FIREWALL" and "MIGRARE - ADD ADMINS", as well as misuse of Active Directory permissions.
A subsequent technical analysis reconstructed the attack as involving multiple known vulnerabilities. The attacker first exploited CVE-2021-35464, a remote code execution vulnerability affecting OpenAM, and subsequently exploited CVE-2024-36401, another remote code execution vulnerability in GeoServer. Both vulnerabilities had publicly available patches before the incident. CybrOps reported that the latter vulnerability was likely used for lateral movement within the infrastructure. The (DNSC) characterized the attack as not complex, citing the exploitation of known, unpatched vulnerabilities and compromised credentials.
A legal debate subsequently emerged over whether the cyberattack could constitute force majeure under Article 1351 of the Romanian Civil Code. The issue affected buyers, sellers, developers and other participants in the real estate market, as the unavailability of the central land registry prevented or delayed real estate transactions, mortgage financing and cadastral procedures. The disruption also created difficulties for developers whose building permits and urbanism certificates were subject to statutory deadlines.
References