Hacker Brings Everything to a Standstill

Land Registry Data Deleted! EU Country Experiences a Cyber Disaster

In Romania, no land registry data can be accessed.(Bild: Dragoș Asaftei - stock.adobe.com)

In Romania, a digital nightmare scenario has come true! A hacker apparently deleted the country’s land registry database. The entire real estate market has been at a standstill ever since—and buyers face new troubles in just a few days.

After a failed extortion attempt against the national land registry authority ANCPI, the hacker began deleting data from the systems. He boasted on the dark web that he had also manipulated the online backups in such a way that recovery would be impossible. In addition, according to media reports, he offered source code and internal data for sale. Since Romania’s land registry and cadastral system is fully digitized, the outage has serious consequences.

It seems like a complete disaster! Now the entire country has come to a standstill: real estate transactions are blocked, notaries can no longer certify sales, banks are not granting mortgages, and proof of ownership can no longer be provided. 

A Catastrophe for Buyers
As the industry portal “Risky Business” reports, citing insider sources, the attacker gained access to the ANCPI using valid login credentials. The incident became public in mid-July and was initially dismissed as a “technical problem.” The Romanian authority has since had to admit to the cyberattack. Official apps and websites have been offline ever since.

The timing of the cyberattack could not be more critical—especially for buyers. As of August 1, 2026, the value-added tax on the purchase of new-construction apartments in Romania is set to rise dramatically from 9 to 21 percent. Since thousands of transactions are blocked before this deadline, citizens face massive additional costs or the loss of their down payments. Numerous purchases of new-construction apartments were planned precisely to be completed before this deadline—which now seems impossible.

The agency has since been working to minimize the damage and avoid causing panic. Contrary to the hacker’s claims, the ANCPI asserts that it has its own “offline backups.” A statement said that staff are working feverishly on the recovery. However, an exact timeline for the resumption of normal operations remains completely unclear.

At the same time, officials point out that information circulating in the public sphere regarding the consequences “corresponds neither to reality nor to the status of the investigation.” The Romanian Parliament has also been convened for a special session. The Senate is now discussing an emergency decree to extend the deadline for the VAT increase.

An Easy Target for Hackers: “passw0rd” as a Password
A hacker with the dark web pseudonym “ByteToBreach” is suspected of being behind the attack. According to IT security experts, this is a criminal operating out of Algeria. He is considered a “technically savvy cybercriminal” who is already known for attacks on government portals. The Romanian Cybersecurity Agency (DNSC) had previously warned the ANCPI several times about glaring security vulnerabilities. 

Outdated operating systems, missing firewalls, and extremely weak passwords paved the way for the attacker. After analyzing the leaked data, the Romanian investigative platform “Public Record” revealed just how easy it was for the hacker. According to the report, the hacker found active employee accounts in the state land registry authority’s system that used extremely weak and common default passwords such as “passw0rd.”