Stolen Credentials Erased Romania's Land Registry

On July 14, Romania's e-Terra platform — the system every notary, lawyer, and cadastral surveyor in the country uses to record property transactions — went dark. The National Agency for Cadastre and Real Estate Advertising (ANCPI) first called it a "technical incident." A day later it admitted to a cyberattack, and by July 15 stolen internal data was up for sale on a dark-web forum. The attacker, operating as ByteToBreach, had walked in with valid credentials, mapped the network, tried to extort the agency, and — when that failed — deleted the registry data and every backup he could reach.

Romania's real-estate market stopped. No transaction recordings, no ownership extracts, no mortgage collateral checks, for over a week. And the timing was brutal: VAT on new homes jumps from 9% to 21% on August 1, so thousands of deals were racing a deadline through a registry that didn't exist.

Here's the part worth sitting with: ANCPI's backups mostly worked. The agency confirmed it stores copies in several locations, including offline, and the attacker didn't get all of them. The data survived. The country's property market still froze for eight days. If your disaster-recovery story ends at "we have immutable backups," this incident is aimed directly at you.

Not an APT. A guy with stealer logs.

The instinct with attacks on national infrastructure is to reach for nation-state framing. Resist it here. KELA has tracked ByteToBreach since mid-2025 and assesses, based on artifacts recovered from infostealer-infected devices, that he's Zakaria Mahdjoub, an individual operating out of Oran, Algeria. One person, running a data-brokering operation across DarkForums and Telegram, complete with a self-promotional website. In March he leaked source code for Sweden's e-government platform after compromising contractor CGI Sverige. Now a national land registry.

The initial access wasn't an exploit chain. It was valid credentials — the kind that leak by the millions through infostealer malware and get resold for pocket change. That's the actual threat model for government systems in 2026: not zero-days, but the intersection of credential markets and networks flat enough that one login reaches the production database, the email servers, the GitLab instance, and a tier of backups. ByteToBreach claims he copied ANCPI's GitLab repositories and source code before wiping, which is why the agency's only sane move — the one it's making — is rebuilding the entire network from scratch and rotating everything. Once your repos walk out the door, assume every embedded secret went with them.

The Romanian press surfaced the number that explains how this was possible: ANCPI reportedly spent RON 710 million (about €135 million) on digitalization over twenty years, and roughly RON 1.6 million — 0.2% — on cybersecurity. Romania's national cyber directorate, DNSC, says it had warned the agency about the very weaknesses the attacker used. This wasn't an unforeseeable failure. It was a priced-in one.

Backups are a number, not a boolean

The brief version of the lesson is "immutable backups and defense-in-depth," and sure. But ANCPI had surviving backups, and it still took more than a week to resume service in careful stages while investigators worked. That's because restoring after a credential-based intrusion isn't pg_restore and go home. You can't put the data back onto infrastructure the attacker mapped and owned — you'd be restoring into a compromised house. Recovery means rebuilding the environment, rotating every credential and secret, verifying integrity of what you're restoring (did he only delete, or also modify?), and bringing services up one at a time. Data recovery is the fast part. Environment recovery is the outage.

That reframes what teams should actually measure. Not "do backups exist" but three numbers you can defend in a postmortem:

• Can the attacker reach them? Backups that share an authentication plane with production are just replicas with extra latency. Object-lock/WORM storage, a separate identity domain for the backup control plane, and at least one copy that's genuinely offline. ByteToBreach deleted the backups he could touch; the ones he couldn't are why Romania still has a land registry.
• How long is restore, really? Timed, end-to-end, including the rebuild-the-world scenario — not a file-level restore test. If you've never drilled "assume total credential compromise, recover to clean infrastructure," your RTO is a guess, and it's low.
• What's the blast radius of one credential? If a single account can enumerate prod, email, source control, and backup tooling, segmentation has failed before the attacker shows up. Phishing-resistant MFA on admin planes and monitoring for your own credentials in stealer-log markets are cheap relative to eight days of national downtime.

Registries are the new favorite target

Romania isn't an outlier; it's a data point in a trend. Land registry and cadastre agencies in Poland, Slovakia, Greece, Morocco, Ukraine, and Russia have all been hit over the past three years. The logic is grim but sound: registries are maximally disruptive (nothing transacts without them), historically underfunded, and sitting on decades of accreted IT. And the wipe-after-failed-extortion pattern is spreading precisely because destruction is the fallback leverage when victims won't pay — Viasat-style destructive endings without the nation-state price tag.

My read: this was the cheapest possible version of the worst-case scenario. The attacker was a lone data broker, not a wiper crew with implants across the estate; offline backups existed; the data appears recoverable. A country's property system still stopped for over a week on a security budget that rounds to zero. Any team running systems people can't route around — registries, payment rails, identity providers — should treat this as their tabletop scenario and run the drill with a stopwatch. The question that matters isn't whether you'd survive. ANCPI survived. It's how many days of standstill your survival costs.