Romania implements NIS2 cybersecurity sanctions and digital health updates

Romania is implementing new cybersecurity measures and digital health initiatives amid several technical incidents. The National Cyber Security Directorate (DNSC) has begun issuing sanctions under the NIS2 Directive, with potential fines reaching 10 million euros for companies in critical sectors that fail to comply with registration and security requirements.

Parliamentary inquiries have highlighted significant vulnerabilities within state institutions. Investigations into a major cyberattack on the National Agency for Cadastre and Real Estate Advertising (ANCPI) revealed that security warnings issued by Cyberint as early as 2021 were ignored, leading to a month-long disruption of real estate transactions. Additionally, the DNSC website recently experienced temporary downtime due to a suspected DDoS attack.

In the healthcare sector, the National Health Insurance House (CNAS) is preparing to launch the 'eSănătateaMea' digital platform on September 1, 2026. The portal will allow citizens to access medical histories, prescriptions, and treatment data. Following a technical error that displayed insensitive terminology regarding persons with disabilities, CNAS issued a public apology and corrected the digital nomenclature.

To combat rising fraud, FAN Courier and the DNSC have also launched an awareness campaign to help users identify fraudulent SMS and WhatsApp messages that illegally use the courier company's branding to steal personal and financial data.