Romania rebuilding land registry systems after cyberattack wipes database

Romania is rebuilding the computer systems of its national land registry agency after a cyberattack deleted its land registry database, disrupting property transactions and limiting access to ownership records.

The attack targeted the National Agency for Cadastre and Real Estate Advertising (ANCPI), which manages the country's land registry and real estate records, says CyberNews.

Cybersecurity firm KELA said the breach was carried out by a threat actor operating under the dark web alias ByteToBreach, whom it identified as Zakaria Mahdjoub, a cybercriminal based in Oran, Algeria. Reuters could not independently verify KELA's attribution. KELA researchers described Mahdjoub as "[A] technically skilled cybercriminal selling sensitive global data from airlines, banks, and governments."

According to KELA, the attacker breached the agency's systems, attempted to extort ANCPI and then deleted the country's land registry database after the extortion attempt failed. ByteToBreach said the stolen material included citizen data, internal documents, employee credentials and the source code for the agency's Eterra and RENNS systems.

"In addition to the data of Romanian citizens... there is also a copy of the GitLab servers containing the source code of all their systems, such as Eterra, RENNS, as well as a version of my little ransomware program."

ByteToBreach made the statement while describing the extent of the data obtained during the breach.

The incident has disrupted Romania's real estate market, with notaries unable to authenticate property sales, register new transactions or record mortgages while the registry remains unavailable.

"I am a notary. Since Tuesday, I cannot issue a land registry extract, I cannot authenticate a sale, I cannot register a mortgage," Romanian notary Ana Stan said, describing the impact of the outage.

Citizens have also been unable to obtain proof of property ownership or access detailed land records.

Romania records between 150,000 and 170,000 residential property sales each year, making the disruption significant for the country's real estate sector.

ANCPI initially attributed the shutdown of its systems to technical problems before later confirming it had been the target of a cyberattack.

Commenting on the agency's initial public explanation, ByteToBreach said:

"The official government website announced a shutdown of IT systems due to 'technical problems,' but this is a bit of an understatement. An offer of assistance was made, but without insistence or pressure."

The attacker also claimed to have attempted to destroy backup copies of the database to prevent recovery. Romanian officials disputed that claim, saying the agency maintained redundant offline backups stored in multiple locations.

In a press release, ANCPI said:

"Contrary to some information appearing in the public space, at the time of the incident, the ANCPI had several locations designated for storing backup copies, a measure that ensures redundancy and the possibility of data restoration..."

The agency has since restored its official website and begun rebuilding its network using those backups. Access to ANCPI's systems remains severely restricted while recovery efforts continue.