Cyberattacks targeting Romanian institutions

Romania has experienced significant cyberattacks targeting both national security infrastructure and financial institutions.

In one instance, Romanian intelligence services and the Special Telecommunications Service (STS) were identified as entities affected by a global cyberattack targeting Fortinet and Palo Alto Networks security equipment. A hacking group known as ‘k0t’ reportedly extracted over 70,000 sets of credentials and access information globally between October 2025 and July 2026. In Romania, the breach potentially impacts various ministries, military structures, and energy sector operators that utilize Fortinet solutions. Technical vulnerabilities allowed attackers to bypass authentication or use brute-force methods to copy sensitive configuration data.

Separately, the Central Depository, which records financial instrument holdings for Romania’s capital market, was targeted by a cyberattack. Unauthorized individuals accessed personal data through the ‘Online Services for Investors’ application. The exposed information included full names, residential addresses, personal identification numbers (CNP), identity card details, email addresses, phone numbers, and IBAN codes. While the data was accessed, the institution reported that financial holdings, settled transactions, and registry activities remained uncompromised and unaffected.