Romania's Land Registry Was Wiped. A Country Lost Its Property Memory for a Week.

On Tuesday, July 14, 2026, a single hacker logged into Romania's national land registry with stolen credentials, and by the end of the week the country had no legal way to prove who owned what.

The week Romania could not sell a house

The system that went dark was e-Terra, the online platform Romanian notaries, lawyers, and cadastral specialists use to register property transactions and pull ownership records. It sits inside the National Agency for Cadastre and Real Estate Advertising, known by its Romanian acronym ANCPI, the single government body that maintains the country's official record of who owns what land. Every sale, every mortgage, every inheritance moves through it. On the morning of July 14, it stopped moving through anything at all.

ANCPI initially described the outage as a "major technical incident." By July 15, 2026, after stolen data began appearing on a dark-web forum, the agency publicly confirmed the incident was a cyberattack. The confirmation caught up with reality that had already been visible on the marketplace: a threat actor calling itself ByteToBreach had claimed responsibility and begun advertising the stolen ANCPI data for sale within 24 hours of the outage.

The operational effect on the country was immediate and unusually total. Risky Business Media summarised the impact plainly: "Notaries can't record new transactions while citizens can't obtain proof of ownership or detailed land records." Banks that needed the registry to confirm collateral could not confirm it. Families in the middle of an inheritance process had nowhere to file. The Romanian real estate market did not slow. It stopped.

How the intruder got in, and what was destroyed

Dan Cimpean, director of Romania's National Directorate for Cyber Security, described the intrusion vector in language that will sound familiar to anyone who has read a breach post-mortem in the last decade. The attacker relied, he said, on "known software vulnerabilities that authorities had recently warned organizations to patch, together with previously leaked credentials." There was no zero-day, no exotic capability, no state-scale toolkit. There was patch discipline that had not caught up, and a set of usernames and passwords that had already leaked somewhere else and been quietly hoarded.

Once inside, the attacker did what a competent financially motivated broker does. They logged in with the stolen credentials, mapped the internal network, staged an extortion demand, and waited. When ANCPI refused to pay, the attacker wiped both the production databases and their local backups. Two systems, one deletion event.

What kept Romania from losing its property record entirely was a decision made long before July 14: ANCPI had kept an offline backup copy of the land registry data. Because the backup was offline, the wiper could not reach it. That single choice is the difference between a week of frozen transactions and a national-scale loss of legal title. ANCPI's core services, including e-Terra, its public websites, and internal email systems, were offline for nearly a full week following the intrusion. The agency then announced it was rebuilding its "entire network from scratch," including migrating core services to Romania's sovereign government cloud.

The persona on the other end of the wire

The attacker did not stay anonymous for long. The Israeli threat-intelligence firm KELA attributes the ByteToBreach persona to Zakaria Mahdjoub, an individual believed to be based in Oran, Algeria. KELA linked the persona to Mahdjoub through infostealer-infected device logs, browser cookies, and reused digital artifacts across four platforms: DarkForums, Dread, Telegram, and a public WordPress site. Romanian authorities have not verified the attribution to any specific person.

ByteToBreach is not a new name. The persona has been active since at least June 2025 and previously breached Sweden's e-government portal earlier in 2026, along with airlines, banks, universities, and other government targets. Cybersecurity analysts classify the operator as a financially motivated initial-access broker, someone who monetises access by extorting victims first and then selling or leaking data if payment fails. That framing matters, because it explains the rhythm of the ANCPI incident precisely: log in with bought credentials, demand money, and if the money does not come, burn the environment down and put the contents up for sale.

The sale listing itself made specific claims. The attacker posted samples on the DarkForums marketplace claiming to hold citizen records, internal ANCPI documents, employee credentials, IT network diagrams, and copies of the agency's GitLab source-code repositories. Romanian authorities publicly downplayed the scope of the theft, saying the exfiltrated information was "limited" and that they had no verified evidence that land registry certificates or bulk personal data left the network. Both statements can be true at once; the market listing is what the seller wants buyers to believe, and the government statement is what defenders have so far been able to prove.

A frozen market, weeks before a tax cliff

The timing of the outage turned a technical failure into a household-level financial event. Romania is in the middle of a fiscal tightening cycle, and the VAT on new-build homes is scheduled to jump from 9 percent to 21 percent within weeks. More than doubling the tax on a typical new-build purchase creates a well-understood queue effect: buyers race to close before the higher rate takes hold. That queue was already forming when e-Terra went dark. For roughly a week, the people in it had no legal way to complete their transactions, and no way to know whether their closing dates would land on the cheap side or the expensive side of the cliff.

The registry outage did not create the tax change, and the tax change did not create the outage. What the two produced together was a case study in concentrated dependency. A single platform, run by a single agency, sitting between millions of private financial decisions and the legal system that ratifies them, can be taken offline by one broker with one set of reused passwords, at exactly the moment when the cost of not being able to transact is highest.

Land registries are becoming a category target

Romania is at least the seventh country in three years to see its national land registry hit, joining Poland, Slovakia, Greece, Morocco, Russia, and Ukraine. That is not a coincidence, and the profile of the ByteToBreach operation helps explain why. Land records are the memory of a country's private wealth. They are enormously valuable to anyone trying to prove or dispute ownership, they are often maintained by agencies whose software budgets have not kept pace with the value they hold, and they sit behind credentials that are recycled across the same infostealer-fed markets where ByteToBreach shops.

What ANCPI has left, after the extortion attempt, the wipe, the sale listing, and the week of darkness, is the offline tape it never plugged in and a decision to rebuild on a sovereign cloud. What Romanian citizens have is a fresh answer to a question most of them never thought to ask: when the state's record of what you own goes away, even briefly, the paper deed in the drawer is not the same thing as ownership. It is a claim waiting for a computer to come back.

Sources

• Risky Business Media reporting on the ANCPI incident
• KELA threat-intelligence attribution of the ByteToBreach persona
• Romania's National Directorate for Cyber Security (DNSC)
• ANCPI, Romania's National Agency for Cadastre and Real Estate Advertising