Romania ANCPI (national cadastre and land registry): data stolen, systems and backups wiped, property market halted

What happened

• The attack froze ANCPI email and the e-Terra cadastre application, blocking mortgage registrations, building-permit applications and cadastral requests nationwide; official sites were down for about a week and HotNews describes a month-long real-estate market blockage. Internal documents, employee credentials and source code were offered for sale. The attacker wiped production systems and claimed to have deleted backups; an offline copy appears to have survived and enabled restoration.
• Root cause: initial access with valid compromised credentials; per Wikipedia’s sources the attacker also exploited CVE-2021-35464 (ForgeRock/OpenAM RCE) and CVE-2024-36401 (GeoServer RCE), both long patched, in an estate with Windows XP/7/Server 2003 hosts. Romania’s DNSC called the attack not complex.
• Attacker: “ByteToBreach” posted the data after a failed extortion attempt; KELA named an alleged operator (per Risky Business). ANCPI refused to pay.
• Response: website restored; officials said the whole network is being rebuilt from scratch; legal debate over force majeure for missed property deadlines.

Sources

• https://risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/
• https://en.wikipedia.org/wiki/2026_ANCPI_hack
• https://balkaninsight.com/2026/07/21/land-registry-cyberattack-exposes-holes-in-romanias-digital-defences/bi/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.