Romanian land registry attack halts property transactions; e-Terra restarts after four weeks
An attack on Romania’s land registry stopped property transactions. e-Terra restarted on 11–12 August, but other platforms awaited restoration in the latest update found. Former ePay users should change their password, including wherever it was reused.
If you used ePay.ancpi.ro, change its password and change it on any other account where you reused it. For Romanian property records or delayed transactions, contact your notary or local land registry office; be cautious of unsolicited requests for personal information, financial details or access codes.
What’s happening
An attack detected on 14 July disrupted Romania’s land registry agency, ANCPI, preventing notaries from registering property transactions and residents from obtaining ownership records. Risky Business reported failed extortion followed by destruction of systems and backups, initially describing the entire registry database as wiped. The Romanian government subsequently said attackers encrypted and deleted part of the application-hosting infrastructure, but the central property-record database remained intact, with no evidence of access to it. Recovery took substantially longer than the first reported week: e-Terra restarted in stages on 11–12 August, and card-payment links returned on 20 August. As of 3 November, the latest agency update found was dated 20 August and still listed several other platforms as awaiting restoration. The reviewed official statements do not establish the final extent of user-data exposure or the outcome of the criminal investigation.
- What
- Breach
- Affects
- Romania’s ANCPI land registry and e-Terra property-record services
- Fixed in
- Nothing to patch
- Since
- 14 July 2026
- Closed
- 20 Aug 2026
Timeline
- Update
ANCPI restored e-Terra’s card-payment links and said 279,242 of 329,476 applications registered during 11–19 August had been resolved. MyEterra, Geoportal and three other platforms still awaited staged restoration.
- Update
The government announced wider professional access to e-Terra after its initial restart on 11 August, when 24,695 applications were registered. Notaries could obtain property extracts again, but card payments and other online platforms remained unavailable.
- Update
The government said the central property-record database was intact, with no evidence attackers accessed it, contradicting the earlier report of its destruction. Infrastructure rebuilding and migration to the government cloud continued; technical and criminal investigations remained open.
- Update
Risky Business reported that an attacker used valid credentials and wiped systems and backups after failed extortion, describing the entire land-registry database as destroyed. It also reported that employee credentials and internal documents were offered for sale on 15 July.
- Made publicNothing to patch
ANCPI detected unauthorised access. The government later confirmed that attackers encrypted and deleted part of the infrastructure hosting the agency’s applications, which was then isolated.
Sources
- e-Terra payment-link functionality reactivatedANCPI · 20 Aug 2026
- Government statement on restoring e-Terra following the cyber incidentRomanian Government via AGERPRES · 27 July 2026
- Government: e-Terra has resumed operationsAGERPRES · 12 Aug 2026
- Risky Bulletin: Hacker wipes Romania’s entire land registry databaseRisky Business · 20 July 2026
- Cyber Brief 26-08 — July 2026CERT-EU · 3 Aug 2026