On 14 July 2026, users of Romania’s e-Terra cadastral and land registry platform found it unavailable. The agency described a “major technical incident”.
It was not technical. An attacker operating as ByteToBreach had logged into the systems of the National Agency for Cadastre and Real Estate Advertising (ANCPI) using valid credentials, mapped the internal network, and attempted to extort the agency. When that failed, they deleted the land registry database — along with the backups and the agency’s email servers.
ANCPI later called it the most serious incident in the institution’s history. For more than a week, Romanians could not obtain proof of property ownership. Notaries could not authenticate sales or register mortgages. The national property market simply stopped.
What happened, in sequence
No exploit chain, no zero-day. Romania’s National Directorate for Cyber Security indicated the attack appeared financially motivated and combined known software vulnerabilities that authorities had recently warned organisations to patch with previously leaked credentials. Both halves of that were publicly available before the attack began.
The number that explains the rest
According to reporting on the agency’s spending, ANCPI invested roughly 710 million lei — about 135 million euros — in digitalisation over two decades. Of that, approximately 0.2 per cent, around 305,000 euros, went to cyber security.
Two decades of digitising the authoritative record of who owns what in an entire country, with a security allocation that would not staff a small team for two years.
This is not a Romanian peculiarity. It is the standard shape of public sector digital transformation everywhere: the business case funds the capability, and security is a line item that gets trimmed because it does not deliver a feature. The bill arrives later, all at once, and is paid by notaries, buyers and sellers rather than by the agency.
Why this incident matters more than a larger data breach
Measured in records, this is not among 2026’s largest incidents. Measured in consequence, it is among the most instructive, for three reasons.
1. It was a destruction attack, not a theft
The extortion failed, so the attacker destroyed instead. That inversion matters. Ransomware at least implies a commercial logic under which paying restores access. A wiper deployed out of spite has no such logic and no negotiation path.
Most organisational risk registers treat “cyber attack” as a confidentiality event: data is taken, individuals are notified, reputation suffers. This was an integrity and availability event, and no amount of previous data exposure made it less effective.
2. The target was an authoritative record with no alternative source
A stolen customer list is damaging. A destroyed land registry is different in kind, because there is no second copy in the world. Ownership of property is whatever the registry says it is. Delete the registry and you have not merely inconvenienced people — you have removed the only mechanism by which ownership can be proven.
Every organisation holds at least one record of this type. A registry. A licence database. A clinical record. A chain of custody. A title. The test is simple: if this were altered or destroyed, could we reconstruct it from anywhere else? Wherever the answer is no, the security requirement is categorically different from the rest of the estate — and is almost never funded that way.
3. The backups were reachable from the same place as production
This is the technical lesson. The attacker had valid credentials, reconnoitred the environment, and destroyed both production and backups. That is only possible where backups sit inside the same administrative trust boundary as the systems they protect.
The question worth putting to your own IT function is not “do we have backups.” It is: would our backups survive an attacker who holds our domain administrator credentials and has had two weeks to look around? For a great many Australian organisations the honest answer is no, and it is usually discovered at the worst possible moment.
Extortion refused, so the attacker destroyed instead. Property transactions halted nationwide. Recovery depended entirely on an offline copy that happened to exist.
Slovakia’s national land registry went offline following a major ransomware event — the same asset class, the same year-on-year pattern, a different attacker.
Greece has also reported attacks against comparable public registry systems. Three European countries, one asset class, one clear conclusion: cadastral registries are being systematically selected.
Australia’s land titles functions run through a mix of state agencies and privatised operators, with electronic conveyancing concentrated in a small number of national platforms. The concentration is comparable and in places higher. Several functions are captured by the Security of Critical Infrastructure Act — a meaningful improvement on the Romanian position, but a risk management program does not automatically produce an offline, immutable, restore-tested backup outside the production trust boundary.
The Australian read
Australia’s land titles functions are delivered through a mix of state agencies and privatised operators, with electronic conveyancing running through a small number of national platforms. The concentration is comparable and, in some respects, higher.
Several such functions are captured by the Security of Critical Infrastructure Act, with obligations for risk management programs and incident reporting. That is a meaningful improvement on the Romanian position. It is not, on its own, an answer to the specific failure that occurred, because a critical infrastructure risk management program does not automatically produce an offline, immutable, restore-tested backup outside the production trust boundary.
Nor is the exposure limited to land titles. The same profile — authoritative record, no alternative source, national or state-wide dependency, historically thin security investment — describes business registers, licensing systems, health identifiers, court records, electoral rolls and utility asset registers.
ASD’s CI Fortify guidance, released in late July 2026, is directly relevant and arrived in the same month. It asks critical infrastructure operators to be capable of running essential services in complete isolation for three months, and lists the coupling points that usually prevent it: shared routing and switching, virtualisation and storage, Active Directory, DNS, DHCP, certificate services and time synchronisation. Those are exactly the dependencies through which an attacker with valid credentials moves from one system to all of them.
Five questions worth asking this week
- Which of our records cannot be reconstructed from any other source? Name them. That list is your real crown jewels, and it is usually shorter and different from the list in the risk register.
- Would our backups survive an attacker with administrator credentials? Offline or immutable, outside the production trust boundary, and restore-tested within the last six months.
- What proportion of our digital investment went to security? If it is closer to Romania’s 0.2 per cent than to a defensible figure, that is a board matter, not an IT matter.
- How would we detect alteration rather than theft? Exfiltration monitoring will not see records being quietly changed.
- What is our manual fallback, and has anyone tested it? Romania’s notaries had no process to fall back on. Neither, in most cases, do we.
The attacker in this case did not use a zero-day, did not deploy novel malware, and did not need to defeat a modern security stack. They logged in with credentials that were already available, looked around, asked for money, and when refused, deleted a country’s property records.
Every precondition for that was visible from outside the organisation. So is yours.