Hacker Wipes Romania’s Land Registry, Freezing the Property Market
Set Trending Topics as a preferred source on Google.
A cyberattack on Romania’s national cadastre agency ANCPI (Agenția Națională de Cadastru și Publicitate Imobiliară) has brought the country’s real-estate market to a near-standstill. According to the security outlet Cybernews, an attacker gained access to the agency’s systems and, following a failed extortion attempt, deleted the entire land registry database.
Cybernews reports that the hacker is believed to have entered the systems using valid credentials. After the agency refused to meet the extortion demand, he is said to have deleted all the data he had previously stolen – including internal documents, employee credentials and the land registry data itself.
Consequences for notaries and buyers
According to Romanian media, ANCPI’s services have been unavailable since 14 July. Per Cybernews, notaries can no longer record new transactions, and citizens can no longer obtain proof of ownership or land registry extracts. The attack has thus effectively halted all property transactions in the country: sales cannot be authenticated and mortgages cannot be registered. Between 150,000 and 170,000 residential properties are sold in Romania each year.
The timing is particularly sensitive: purchases of new homes currently qualify for a reduced VAT rate of 9 percent. From 1 August that rate rises to 21 percent – and many deals had been scheduled to close before the deadline.
Agency calls it a “cybersecurity incident”
ANCPI initially spoke of technical problems but later acknowledged a cyberattack, and now refers to the case as a “cybersecurity incident.” According to the agency, it holds offline backup copies stored at several locations that would allow the deleted data to be restored. At the same time, it stresses that some of the information circulating publicly about the consequences does not come from official sources. Work to restore the systems is under way, the agency says.
Criticism over lack of preparedness
In Romania, ANCPI is facing criticism over its handling of IT security. According to Cybernews, the agency invested around 135 million euros in digitalization over the past 20 years, but only about 0.2 percent of that – roughly 305,000 euros – in cybersecurity. Romania’s national cybersecurity body, the DNSC, says it had previously warned ANCPI about vulnerabilities. ANCPI director Dan Cîmpean reportedly conceded that the attack was not especially complex and could have been prevented.
Suspect named
The attack is attributed by Cybernews to a dark web account called “ByteToBreach,” which is said to have already breached a Swedish e-government portal earlier this year. The security firm KELA links the account to an individual based in Oran, Algeria, describing the person as a technically skilled cybercriminal who sells sensitive data from airlines, banks and governments. This attribution has not been independently confirmed. According to Cybernews, ByteToBreach is also said to be responsible for attacks on government registries in Slovakia, Ukraine, Poland and Lithuania.
