Inside the Wipe: How a Single Attacker Took Down Romania's Land Registry Database

On Tuesday, July 14, 2026, Romania's National Agency for Cadastre and Land Registration (ANCPI) went dark. The outage took down e-Terra, the single nationwide platform that records every property sale, mortgage, and land title in the country, along with the agency's email and the apps notaries and lawyers rely on.

There is no fallback. e-Terra is the only system for registering property transactions in Romania, so when it stopped, the country's real estate market froze with it. Deals that needed a title update simply could not close.

ANCPI first called it a "technical incident." Within about 48 hours the label had climbed to "the most extensive technical disruption in the institution's history." That escalation is the first clue this was not a bad server day.

Dan Cimpean, director of Romania's cyber security agency DNSC, told outlet G4Media the break-in "wasn't a very complex attack." The attacker combined previously leaked credentials with known software vulnerabilities that authorities had recently warned organizations to patch.

That is the mundane, uncomfortable part. No exotic exploit chain, just valid logins that should have been rotated and patches that should have been applied. Once inside, the attacker moved laterally to map internal systems before making any demands.

The attacker goes by ByteToBreach. Intelligence firm KELA Cyber assesses the actor as financially motivated, active since at least mid-2025, with a track record of hitting banking, telecom, and government targets across several countries. DNSC's Cimpean pegged them as an initial access broker, not a state-backed group.

This was not a one-off. ByteToBreach reportedly hit Latvia State Forests the month before and Sweden's e-government portal earlier in the year. Romania fit an existing pattern of serial government-sector breaches.

After the ANCPI hack, KELA publicly named the person behind the alias: Zakaria Mahdjoub, reportedly based in Oran, Algeria. A person claiming to be the hacker even gave Euronews Romania a Signal interview, apologizing to Romanians, though Recorded Future News could not verify the identity.

On July 15, ByteToBreach advertised ANCPI data on the DarkForums marketplace: citizen data, internal databases, and a copy of the GitLab servers holding source code for e-Terra, RENNS, and other systems. The post claimed a "little ransomware program" had been deployed.

According to Catalin Cimpanu's Risky Bulletin, sourced to unnamed insiders, the extortion attempt failed, and the attacker responded by wiping both the live database and its backups. Officials then posted about rebuilding the agency's entire network from scratch, which suggests they leaned on an offline backup copy to recover at all.

The lesson buried in that sequence: a wiper only wins if it can reach everything. An offline, air-gapped backup is the difference between a week-long outage and a permanent loss of a nation's property records.

Here the accounts split, and it matters. ANCPI's own statements insist the core technical and legal databases (property boundaries, maps, ownership, mortgages) were not compromised, and that investigators found no evidence citizen data or land certificates were stolen.

The "wipe" framing comes specifically from Risky Business's unnamed sources, not from ANCPI. A separate ransomware-encryption claim, based on Google-indexed .encrypted files, appears in only one low-authority blog and is not corroborated elsewhere. Treat both as reported, not confirmed.

By July 20, with the outage running nearly a week, ANCPI said it was migrating applications to the Romanian government cloud, aiming to finish mid-week and then verify integrity before a gradual restore. Cimpean noted attackers did exfiltrate a "limited amount" of data, including user credentials and application source code.