A Hacker Deleted Romania’s Land Registry.
The national property market stopped.

Which of your systems holds a record that cannot be reconstructed from anywhere else? A passive external assessment is where the honest answers begin: what you expose to the outside world, and who owns that risk.

Assess Your Exposure →

On 14 July 2026, users of Romania’s e-Terra cadastral and land registry platform found it unavailable. The agency described a “major technical incident”.

It was not technical. An attacker operating as ByteToBreach had logged into the systems of the National Agency for Cadastre and Real Estate Advertising (ANCPI) using valid credentials, mapped the internal network, and attempted to extort the agency. When that failed, they deleted the land registry database — along with the backups and the agency’s email servers.

ANCPI later called it the most serious incident in the institution’s history. For more than a week, Romanians could not obtain proof of property ownership. Notaries could not authenticate sales or register mortgages. The national property market simply stopped.

Romania — ANCPI, July 2026
0
of ANCPI’s two-decade digitalisation spend went to cyber security
0
euros invested in digitalisation since ~2006
0
VAT rise on new homes due 1 August, mid-outage
0
with no proof of property ownership obtainable
Sources: ANCPI statements; Balkan Insight reporting on ANCPI expenditure; Romanian Government fiscal package.
Timing that made it worseRomania’s VAT rate on newly built homes was scheduled to rise from 9 to 21 per cent on 1 August. Buyers racing to settle before the deadline found the registry gone. For a purchaser mid-transaction, the outage translated directly into thousands of euros.

What happened, in sequence

The attack, stage by stage
14 July 2026 — Stage 1
The attacker logged in

No exploit chain, no zero-day. Romania’s National Directorate for Cyber Security indicated the attack appeared financially motivated and combined known software vulnerabilities that authorities had recently warned organisations to patch with previously leaked credentials. Both halves of that were publicly available before the attack began.

Click any point to read what happened
Sources: ANCPI; Romania’s National Directorate for Cyber Security via Romanian media; Help Net Security, The Record, Cybernews, Risky Business, Balkan Insight.

The number that explains the rest

According to reporting on the agency’s spending, ANCPI invested roughly 710 million lei — about 135 million euros — in digitalisation over two decades. Of that, approximately 0.2 per cent, around 305,000 euros, went to cyber security.

Two decades of digitising the authoritative record of who owns what in an entire country, with a security allocation that would not staff a small team for two years.

This is not a Romanian peculiarity. It is the standard shape of public sector digital transformation everywhere: the business case funds the capability, and security is a line item that gets trimmed because it does not deliver a feature. The bill arrives later, all at once, and is paid by notaries, buyers and sellers rather than by the agency.

Why this incident matters more than a larger data breach

Measured in records, this is not among 2026’s largest incidents. Measured in consequence, it is among the most instructive, for three reasons.

1. It was a destruction attack, not a theft

The extortion failed, so the attacker destroyed instead. That inversion matters. Ransomware at least implies a commercial logic under which paying restores access. A wiper deployed out of spite has no such logic and no negotiation path.

Most organisational risk registers treat “cyber attack” as a confidentiality event: data is taken, individuals are notified, reputation suffers. This was an integrity and availability event, and no amount of previous data exposure made it less effective.

2. The target was an authoritative record with no alternative source

A stolen customer list is damaging. A destroyed land registry is different in kind, because there is no second copy in the world. Ownership of property is whatever the registry says it is. Delete the registry and you have not merely inconvenienced people — you have removed the only mechanism by which ownership can be proven.

Every organisation holds at least one record of this type. A registry. A licence database. A clinical record. A chain of custody. A title. The test is simple: if this were altered or destroyed, could we reconstruct it from anywhere else? Wherever the answer is no, the security requirement is categorically different from the rest of the estate — and is almost never funded that way.

3. The backups were reachable from the same place as production

This is the technical lesson. The attacker had valid credentials, reconnoitred the environment, and destroyed both production and backups. That is only possible where backups sit inside the same administrative trust boundary as the systems they protect.

The question worth putting to your own IT function is not “do we have backups.” It is: would our backups survive an attacker who holds our domain administrator credentials and has had two weeks to look around? For a great many Australian organisations the honest answer is no, and it is usually discovered at the worst possible moment.

Not an isolated caseSlovakia’s national land registry went offline in 2025 following a major ransomware event, and Greece has reported attacks on comparable systems. Gartner projected in 2024 that more than 75 per cent of government and public sector organisations would experience at least one ransomware or extortion-focused incident by 2026. Cadastral and public registries are being systematically targeted because the consequence of outage is enormous and the defensive investment is typically minimal.
One asset class, four jurisdictions
ANCPI — land registry wiped
14 July 2026 · valid credentials · destructive
0.2%of digitalisation spend on security
7+days of national outage
Yesbackups also destroyed

Extortion refused, so the attacker destroyed instead. Property transactions halted nationwide. Recovery depended entirely on an offline copy that happened to exist.

National land registry taken offline
2025 · ransomware
Nationalscope of outage
Cadastresystem affected

Slovakia’s national land registry went offline following a major ransomware event — the same asset class, the same year-on-year pattern, a different attacker.

Comparable registry systems reported attacked
Public registry targeting
Registryasset class
Publicsector

Greece has also reported attacks against comparable public registry systems. Three European countries, one asset class, one clear conclusion: cadastral registries are being systematically selected.

Land titles across state agencies and privatised operators
SOCI-captured in part · not yet tested this way
Mixedstate agencies and private operators
SOCIpartial regulatory coverage
?offline backup position

Australia’s land titles functions run through a mix of state agencies and privatised operators, with electronic conveyancing concentrated in a small number of national platforms. The concentration is comparable and in places higher. Several functions are captured by the Security of Critical Infrastructure Act — a meaningful improvement on the Romanian position, but a risk management program does not automatically produce an offline, immutable, restore-tested backup outside the production trust boundary.

Select a jurisdiction
Sources: ANCPI and Romanian DNSC; public reporting on the 2025 Slovak land registry incident; Gartner public sector ransomware projections; Security of Critical Infrastructure Act 2018 (Cth).

The Australian read

Australia’s land titles functions are delivered through a mix of state agencies and privatised operators, with electronic conveyancing running through a small number of national platforms. The concentration is comparable and, in some respects, higher.

Several such functions are captured by the Security of Critical Infrastructure Act, with obligations for risk management programs and incident reporting. That is a meaningful improvement on the Romanian position. It is not, on its own, an answer to the specific failure that occurred, because a critical infrastructure risk management program does not automatically produce an offline, immutable, restore-tested backup outside the production trust boundary.

Nor is the exposure limited to land titles. The same profile — authoritative record, no alternative source, national or state-wide dependency, historically thin security investment — describes business registers, licensing systems, health identifiers, court records, electoral rolls and utility asset registers.

ASD’s CI Fortify guidance, released in late July 2026, is directly relevant and arrived in the same month. It asks critical infrastructure operators to be capable of running essential services in complete isolation for three months, and lists the coupling points that usually prevent it: shared routing and switching, virtualisation and storage, Active Directory, DNS, DHCP, certificate services and time synchronisation. Those are exactly the dependencies through which an attacker with valid credentials moves from one system to all of them.

Five questions worth asking this week

  • Which of our records cannot be reconstructed from any other source? Name them. That list is your real crown jewels, and it is usually shorter and different from the list in the risk register.
  • Would our backups survive an attacker with administrator credentials? Offline or immutable, outside the production trust boundary, and restore-tested within the last six months.
  • What proportion of our digital investment went to security? If it is closer to Romania’s 0.2 per cent than to a defensible figure, that is a board matter, not an IT matter.
  • How would we detect alteration rather than theft? Exfiltration monitoring will not see records being quietly changed.
  • What is our manual fallback, and has anyone tested it? Romania’s notaries had no process to fall back on. Neither, in most cases, do we.

The attacker in this case did not use a zero-day, did not deploy novel malware, and did not need to defeat a modern security stack. They logged in with credentials that were already available, looked around, asked for money, and when refused, deleted a country’s property records.

Every precondition for that was visible from outside the organisation. So is yours.

Would you survive the same attack?
Tick every statement that is true of your organisation today.
We hold at least one record that could not be reconstructed from any other source.
Our backups are offline or immutable, outside the production trust boundary.
We have completed a restore test in the last six months.
Backup infrastructure uses credentials separate from production administration.
We could detect records being altered, not just copied or deleted.
We have a manual fallback process, and someone has tested that it absorbs real volume.
We know what proportion of our digital investment goes to security.
Tick every statement that is true of your organisation
Passive only — no systems accessedBlackFlag Advisory identifies the externally reachable access paths into the systems holding your authoritative records — remote access, management interfaces, forgotten hosts, and credentials appearing in published corpora. Exclusively passive OSINT using publicly available data. No systems, networks or accounts are accessed, probed or tested.
SourcesANCPI public statements (July 2026); Romania’s National Directorate for Cyber Security via Romanian media; Help Net Security, The Record, Cybernews, Risky Business and Balkan Insight reporting on the ANCPI incident; reporting on ANCPI digitalisation and cyber security expenditure; Gartner public sector ransomware projections; ASD CI Fortify guidance (July 2026); Security of Critical Infrastructure Act 2018 (Cth). Analysis by BlackFlag Advisory.

Some Records Cannot Be Rebuilt
From Anywhere Else.

A BlackFlag Advisory passive assessment identifies the externally reachable paths into the systems holding your authoritative records — before someone else maps them.

Request an Assessment →
Passive Only — No Systems Accessed

All BlackFlag Advisory assessments use exclusively passive OSINT techniques and publicly available data sources. No systems, networks, or accounts are accessed, probed, or tested at any time. Board-ready output delivered within three to seven business days.