Romania Land Registry Hack Paralyzes Property Market

A Romania land registry hack has disrupted property sales, mortgage registrations, and ownership checks across the country after an attacker reportedly deleted data from the national cadastre agency.

The attack targeted the National Agency for Cadastre and Real Estate Advertising, known as ANCPI. Initially, the agency described the outage as a technical problem. However, it later confirmed that its systems had suffered a cyberattack.

As a result, notaries and citizens have been unable to access essential land registry services.

Property Transactions Come to a Halt

The Romania land registry hack has brought major parts of the country’s real-estate market to a standstill.

Notaries reportedly cannot issue land registry extracts, authenticate property sales, or register new mortgages. Meanwhile, property owners cannot obtain official proof of ownership or detailed records for land and buildings.

This creates a serious obstacle for buyers, sellers, banks, and legal professionals. Romania records roughly 150,000 to 170,000 residential property sales each year, so even a short disruption could affect a large number of planned transactions.

Attacker Reportedly Deleted Stolen Data

The attacker claimed to have gained access to ANCPI systems using valid credentials. They also claimed to have copied sensitive material, including internal documents, employee credentials, source code, and data from agency systems.

According to reports, the attacker attempted to extort the agency. When that effort failed, they allegedly deleted the stolen information, including land registry data.

The person behind the attack also claimed to have targeted backup copies in an effort to prevent the agency from restoring its systems. However, those claims have not been independently verified.

Offline Backups May Limit the Damage

ANCPI has since restored its public website and said it is rebuilding its network from scratch.

Importantly, the agency said it had several separate locations for storing backup copies of its data. These offline backups could allow officials to restore the affected land registry information despite the reported deletion.

The availability of isolated backups is crucial during destructive cyberattacks. Attackers increasingly target backup systems because they know organisations rely on them to recover from ransomware and data-wiping incidents.

If ANCPI’s copies remain intact, the agency may be able to restore its records. Still, rebuilding systems and validating a national database can take time.

Security Researchers Link Attack to Known Campaign

A cybersecurity firm has linked the campaign to a threat actor operating under the name ByteToBreach. The group has previously claimed attacks against public-sector organisations in several European countries.

Researchers describe the actor as technically capable and focused on stealing and selling sensitive data from governments, banks, airlines, and other organisations.

The Romania land registry hack highlights the damage that can follow when attackers access government systems through compromised credentials. In this case, the immediate impact has reached beyond the affected agency and into the country’s wider property market.