Buildings in the historic town of Sighișoara, Romania, stand as a testament to the country's rich history, but a recent cyberattack has brought the nation's property market to a standstill. The National Agency for Cadastre and Land Registration (ANCPI) reported that a cyberattack had taken out the country's digital registry systems, disrupting online land registry services, official email systems, and applications used by notaries, lawyers, cadastral specialists, and ANCPI employees.
Cyberattack Disrupts Property Market
The agency disclosed that it had suffered what it described as 'the most serious technical incident in the institution's history' after a cyberattack disabled its central IT infrastructure, including the nationwide e-Terra cadastral and land registry platform. The outage has prevented authorities from registering new property transactions or processing existing requests, bringing real estate transactions across the country to a grinding halt.
Efforts to Restore Services
ANCPI said it is continuing efforts to restore services that have been offline for nearly a week, with the agency beginning to migrate its applications to the Romanian government cloud. This process is expected to finish on Wednesday, after which authorities will verify the integrity of the systems before gradually restoring services. The primary objective is to protect data integrity and eliminate all identified vulnerabilities, with affected systems remaining isolated until every identified security weakness has been addressed.
According to Dan Cimpean, director of Romania's National Directorate for Cyber Security (DNSC), the attack appeared to be financially motivated and was carried out by exploiting known software vulnerabilities that authorities had recently warned organizations to patch, together with previously leaked credentials. 'It wasn't a very complex attack,' Cimpean said, adding that investigators had so far found no evidence that personal data or land registry certificates had been stolen, although the attackers had allegedly exfiltrated a limited amount of information, including user credentials and application source code.
Threat Actor Claims Responsibility
A threat actor using the name ByteToBreach claimed responsibility for the attack, advertising what it said was stolen ANCPI data for sale on an underground forum, including internal databases and source code for the e-Terra system. Cimpean said Romanian authorities believe ByteToBreach is an initial access broker that targets poorly protected systems for financial gain rather than a state-backed hacking group. He said investigators suspect the threat actor is based in Algeria, although this claim has not been verified.
Israel-based cybersecurity firm Kela has attributed the ByteToBreach persona to Zakaria Mahdjoub, an alleged cybercriminal based in Oran, Algeria, who it describes as a prolific seller of stolen government, banking, and airline data. In an interview with Euronews Romania, a person claiming to be the hacker apologized to Romanians and IT professionals for the intrusion and, when asked whether citizens should be concerned about stolen data, replied: 'I don't sell this data to just anyone.'
Impact on Property Market
The disruption comes just weeks before Romania will raise the value-added tax on new homes to 21% from 9%, reportedly delaying transactions that many buyers and developers had hoped to complete before the higher tax takes effect. Because the country's cadastral and land registry system is fully digital, authorities cannot register new property transactions, process existing applications, or issue land registry extracts required for home sales and mortgage registrations, ANCPI said.
The cyberattack has significant implications for Romania's property market, with many transactions put on hold until the land registry systems are restored. The agency's efforts to restore services and protect data integrity are crucial in minimizing the impact of the attack and ensuring the continuity of the property market.
Source: The Record