{"id":"romania-land-registry-extortion-jul-2026","category":"breach","status":"closed","title":"Romanian land registry attack halts property transactions; e-Terra restarts after four weeks","tldr":"An attack on Romania’s land registry stopped property transactions. e-Terra restarted on 11–12 August, but other platforms awaited restoration in the latest update found. Former ePay users should change their password, including wherever it was reused.","summary":"An attack detected on 14 July disrupted Romania’s land registry agency, ANCPI, preventing notaries from registering property transactions and residents from obtaining ownership records. Risky Business reported failed extortion followed by destruction of systems and backups, initially describing the entire registry database as wiped. The Romanian government subsequently said attackers encrypted and deleted part of the application-hosting infrastructure, but the central property-record database remained intact, with no evidence of access to it. Recovery took substantially longer than the first reported week: e-Terra restarted in stages on 11–12 August, and card-payment links returned on 20 August. As of 3 November, the latest agency update found was dated 20 August and still listed several other platforms as awaiting restoration. The reviewed official statements do not establish the final extent of user-data exposure or the outcome of the criminal investigation.","action":"If you used ePay.ancpi.ro, change its password and change it on any other account where you reused it. For Romanian property records or delayed transactions, contact your notary or local land registry office; be cautious of unsolicited requests for personal information, financial details or access codes.","product":"Romania’s ANCPI land registry and e-Terra property-record services","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["romania","ancpi","land-registry","extortion","ransomware","service-disruption"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"e-Terra payment-link functionality reactivated","url":"https://ancpi.ro/","by":"ANCPI","date":"2026-08-20"},{"kind":"advisory","title":"Government statement on restoring e-Terra following the cyber incident","url":"https://agerpres.ro/comunicate/2026/07/27/comunicat-de-presa---guvern--1579578","by":"Romanian Government via AGERPRES","date":"2026-07-27"},{"kind":"news","title":"Government: e-Terra has resumed operations","url":"https://agerpres.ro/politic/2026/08/12/guvern-aplicatia-informatica-e-terra-si-a-reluat-activitatea--1584272","by":"AGERPRES","date":"2026-08-12"},{"kind":"news","title":"Risky Bulletin: Hacker wipes Romania’s entire land registry database","url":"https://news.risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/","by":"Risky Business","date":"2026-07-20"},{"kind":"research","title":"Cyber Brief 26-08 — July 2026","url":"https://www.cert.europa.eu/publications/threat-intelligence/cb26-08/","by":"CERT-EU","date":"2026-08-03"}],"started":"2026-07-14","closed":"2026-08-20","created":"2026-11-03T21:18:06.973Z","updated":"2026-11-03T21:18:06.973Z","cve_notes":[],"timeline":[{"at":"2026-08-20","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"ANCPI restored e-Terra’s card-payment links and said 279,242 of 329,476 applications registered during 11–19 August had been resolved. MyEterra, Geoportal and three other platforms still awaited staged restoration.","url":"https://ancpi.ro/","by":"ANCPI","patch":null},{"at":"2026-08-12","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"The government announced wider professional access to e-Terra after its initial restart on 11 August, when 24,695 applications were registered. Notaries could obtain property extracts again, but card payments and other online platforms remained unavailable.","url":"https://agerpres.ro/politic/2026/08/12/guvern-aplicatia-informatica-e-terra-si-a-reluat-activitatea--1584272","by":"AGERPRES","patch":null},{"at":"2026-07-27","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"The government said the central property-record database was intact, with no evidence attackers accessed it, contradicting the earlier report of its destruction. Infrastructure rebuilding and migration to the government cloud continued; technical and criminal investigations remained open.","url":"https://agerpres.ro/comunicate/2026/07/27/comunicat-de-presa---guvern--1579578","by":"Romanian Government via AGERPRES","patch":null},{"at":"2026-07-20","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Risky Business reported that an attacker used valid credentials and wiped systems and backups after failed extortion, describing the entire land-registry database as destroyed. It also reported that employee credentials and internal documents were offered for sale on 15 July.","url":"https://news.risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/","by":"Risky Business","patch":null},{"at":"2026-07-14","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"ANCPI detected unauthorised access. The government later confirmed that attackers encrypted and deleted part of the infrastructure hosting the agency’s applications, which was then isolated.","url":"https://agerpres.ro/comunicate/2026/07/27/comunicat-de-presa---guvern--1579578","by":"Romanian Government via AGERPRES","patch":"na"}],"url":"https://hard.fyi/live/romania-land-registry-extortion-jul-2026/","json":"https://hard.fyi/api/live?id=romania-land-registry-extortion-jul-2026"}