Overview
- On July 14 the national cadastre ANCPI went offline after an intruder using valid credentials gained access, tried to extort the agency and then claimed to have deleted the land‑register and its backups.
- Official ANCPI apps and websites remain largely down, preventing notaries from issuing deeds, blocking mortgage registration and leaving many property transactions in limbo ahead of an August 1 VAT increase.
- ANCPI says it holds multiple backups, is reinstalling and consolidating systems, and began migrating affected applications to the Romanian government cloud with a migration target around July 22 to begin phased recovery and verification.
- Romania’s National Cyber Security Directorate and security firms report the attacker exploited known, preventable failures such as outdated software, weak or compromised passwords and exposed credentials.
- Cybersecurity firm KELA links the Dark Web account 'ByteToBreach' to a suspected operator named Zakaria Mahdjoub in Oran and portions of ANCPI data and employee credentials have appeared for sale, increasing privacy and fraud risks and shaping forensic priorities.