Romania’s cadastral system hack freezes property market

Romania ANCPI ransomware property market ByteToBreach

A ransomware attack attributed to the hacker known as ByteToBreach hit Romania’s National Agency for Cadastre and Real Estate Publicity (ANCPI) on 14 July 2026. The attackers encrypted and deleted hundreds of thousands of files, including land‑registry contracts and notarial records, while the central cadastral database itself remained intact. The Romanian government refused to pay the ransom, prompting the hacker to threaten further data destruction.

The breach halted property transactions nationwide, froze mortgage approvals and stopped notaries from accessing cadastral records, affecting an estimated 30 000–35 000 real‑estate deals. The incident occurred shortly before a VAT increase on property sales from 9 % to 21 % slated for 1 August. ANCPI, the National Directorate for Cyber‑Security (DNSC) and the cybersecurity firm KELA are cooperating to restore services and restart the e‑Terra platform, though no firm restart date has been given. The agency had allocated only 0.2 % of its budget to cyber‑defence prior to the attack, highlighting systemic vulnerabilities.

Entities

ANCPI · ByteToBreach · Cyberint · Dan Cimpean · KELA · National Agency for Cadastre and Real Estate Publicity (ANCPI) · National Cyber Defense Center (DNSC) · Romanian Government · Secure Telecommunication Service (STS) · e‑Terra system

Claims

What the coverage asserts, and how many sources carry each claim.

[● 5 SOURCES] A hacker using the alias ByteToBreach carried out a ransomware attack on Romania's cadastre system. www.notizie.it · www.adginforma.it · www.liberoquotidiano.it · www.tgcom24.mediaset.it · www.cybersecurity360.it
[● 3 SOURCES] The Romanian government refused to pay the ransom demanded by the hacker. www.notizie.it · www.adginforma.it · www.liberoquotidiano.it
[● 3 SOURCES] Dan Cimpean, director of the DNSC, said the attacker acts as an “initial‑access broker”. www.adginforma.it · www.notizie.it · www.cybersecurity360.it
[● 2 SOURCES] ANCPI allocated only 0.2 % of its budget to cyber‑defence before the attack. www.adginforma.it · www.notizie.it
[DISPUTED] The attacker deleted hundreds of thousands of files, including land‑registry contracts and notarial records. www.notizie.it · www.adginforma.it · www.cybersecurity360.it
[● 6 SOURCES] The attack halted property transactions, froze mortgage approvals and prevented notaries from accessing records. www.notizie.it · cvlpress.ro · www.liberoquotidiano.it · www.tgcom24.mediaset.it · gazetadebistrita.ro · +1 more
[● 3 SOURCES] The attack occurred shortly before a VAT increase on property sales from 9 % to 21 % effective 1 August. www.adginforma.it · www.notizie.it · www.liberoquotidiano.it
[● 5 SOURCES] ANCPI confirmed the breach and is cooperating with the National Directorate for Cyber‑Security and KELA to restore services. cvlpress.ro · www.cybersecurity360.it · gazetadebistrita.ro · psnews.ro · www.adginforma.it
[DISPUTED] The central cadastral database remained intact and was not accessed by the attackers. gazetadebistrita.ro · psnews.ro · www.adginforma.it