Hacker Wipes Romania's Entire Land Registry, Freezing All Property Transactions

One Hacker Wiped Romania's Entire Property Registry. Seven Countries Have Now Had Theirs Hit.

Someone deleted the database that records who owns what. The National Agency for Cadastre and Real Estate Advertising, or ANCPI, maintains Romania's entire land registry. A hacker breached the agency, failed to extort it, and then wiped the country's property ownership records, along with connected backups 1.

The results were immediate and total. Notaries could not record new transactions. Citizens could not pull proof of ownership or request land records. ANCPI's public-facing apps, websites, and email servers all went offline 1. Every step in a real estate transaction that depends on a title check, a deed filing, or a mortgage registration simply stopped. The entire property market froze.

The attacker, who operates under the handle ByteToBreach, entered ANCPI's systems using valid credentials, mapped the internal network, and wiped live systems and backups after the extortion attempt failed 1. The breach became public on July 14, 2026, as the data destruction began. The next day, stolen ANCPI material appeared for sale on a hacking forum: employee credentials, internal documents, and details about the agency's IT infrastructure 1.

Security firm KELA had profiled ByteToBreach in December 2025, suggesting the hacker might be based in Algeria. After the ANCPI breach, KELA updated its assessment and publicly identified the attacker as Zakaria Mahdjoub, an individual from Oran, Algeria 1. ByteToBreach is also linked to a breach of Sweden's e-government portal earlier this year, along with multiple other government agencies and companies over the past year 1.

ANCPI officials have since restored their website and posted a message confirming they are rebuilding the agency's entire network from scratch 1. The agency appears to have maintained an offline backup copy, which is why the recovery, while slow, is proceeding rather than collapsing into months-long uncertainty 1.

But the fact that the attacker could wipe live systems and connected backups in the same operation reveals the core design problem. If your production data and your recovery data are reachable through the same credentials, you do not have a backup. You have a second copy of the same risk.

Seven Countries, Same Target

Romania is not the first country to discover this. It is the seventh.

Over the past three years, national land registry agencies in Poland, Slovakia, Greece, Morocco, Russia, and Ukraine have all been breached 1. The methods vary. The target is always the same: a centralized database that functions as the single authoritative record of who owns what.

That centralization is what makes these agencies such effective targets. A national registry concentrates the property records of an entire country into one system, controlled by one agency. The payoff for an attacker is enormous. The defensive baseline is, in too many cases, ordinary government IT.

The fix is not exotic. Segregated offline backups that no set of administrative credentials can reach. Multi-factor authentication on every privileged account. Network segmentation that prevents an intruder who breaches one segment from reaching recovery systems. These are foundational controls. They were apparently not implemented robustly enough at an agency that holds the property records of an entire nation.

What This Means If You Own Property

If you hold a deed, your proof of ownership almost certainly lives in a government database like Romania's. Title insurance covers disputes over ownership. It is not designed for the scenario where the underlying records themselves vanish. Lenders depend on registry access to verify that a property is free of competing claims before approving a mortgage. When the registry goes offline, that pipeline stops cold.

Romania's week-long shutdown is a preview of what a sustained outage looks like in any country running the same architecture: one registry, one agency, one set of credentials between an attacker and the complete property record of a nation.

The registry will come back. The data will likely be restored from that offline copy. But the structural question remains unanswered across Europe and beyond. Seven countries in three years have now learned that their single most important civic database is also their single most exploitable one. The eighth is a matter of when, not if.