1. Executive summary
A threat actor using the handle "ByteToBreach" breached Romania's National Agency for Cadastre and Real Estate Advertising (ANCPI) using valid credentials, mapped internal systems, and wiped the country's entire land registry database and backups after a failed extortion attempt. The incident became public on 14 July 2026; stolen data — including employee credentials, internal documents, and IT network details — was posted for sale on a known hacking forum the following day. Attribution to "ByteToBreach" (doxxed by KELA as Zakaria Mahdjoub of Oran, Algeria) is unconfirmed — the actor has no MITRE ATT&CK profile. EMEA financial services clients with exposure to Romanian real-estate transactions, collateral verification, or property-linked lending face operational disruption: notaries cannot record transactions and citizens cannot obtain proof of ownership. The incident underscores the destructive potential of credential-based access followed by backup wiping in government registries that financial institutions depend on for due diligence.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | Financial firms relying on ANCPI registry data for collateral verification and property transactions face an outage of a critical external ICT-dependent service provider. | Clients must assess whether their operational reliance on Romanian land registry data triggers third-party risk review and continuity planning under DORA Art. 28. |
| DORA Art. 18: classification of ICT-related incidents and cyber threats | The breach and data wipe at a government registry that financial institutions depend on constitutes a cyber threat with potential to cause operational disruption to downstream financial services. | Clients should classify any downstream impact (e.g., inability to verify collateral, delayed property transactions) as an ICT-related incident under DORA Art. 18 if it affects their own operations. |
No NIS2 or UK NIS article is directly engaged for EMEA financial services clients by this item. The incident itself falls under Romanian national authority scope; clients' obligations arise only if they experience a qualifying downstream incident under their own NIS2/UK NIS duties.
3. Technical analysis & attack chain
This is a breach-incident. The following attack chain is reconstructed from the source material; all claims are single-sourced (Risky Business, citing unnamed sources) unless otherwise noted.
- Initial access — valid credentials. The attacker entered ANCPI systems using valid credentials. The source does not specify whether credentials were obtained via phishing, credential stuffing, prior breach, insider access, or purchase from the forum where ANCPI data was later sold. The mechanism is unconfirmed.
- Internal reconnaissance. The attacker mapped internal systems post-access. No specific tools, techniques, or duration are described.
- Extortion attempt. The attacker attempted to extort ANCPI. The method of contact, ransom demand, and timeline relative to initial access are not specified.
- Data theft. Prior to or during the extortion attempt, the attacker exfiltrated employee credentials, internal documents, and details on ANCPI's IT network. The exfiltration method and volume are not described.
- Destructive wipe — systems and backups. After extortion failed, the attacker wiped systems and backups. The source does not specify the wiping mechanism, malware used, or whether the wipe targeted specific database instances, storage arrays, or virtual infrastructure. The attacker claims backups were deleted; ANCPI appears to have retained an offline copy that enabled partial recovery.
- Data sale. On 15 July 2026 (one day after the wipe became public), stolen data was posted for sale on a known hacking forum by an account named "ByteToBreach." The posted data included employee credentials, internal documents, and IT network details.
- Impact. ANCPI official apps and websites went offline. Email servers were also taken down. Romania's real-estate market halted — notaries cannot record transactions, citizens cannot obtain proof of ownership or land records. As of publication, the outage had lasted approximately one week. ANCPI is rebuilding its entire network from scratch.
Attribution caveat: The actor "ByteToBreach" has no MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed. KELA published a profile in December 2025 suggesting the actor may be located in Algeria and subsequently updated it to name Zakaria Mahdjoub of Oran, Algeria. This doxxing is single-sourced (KELA via Risky Business); verify before enforcement. The source states ByteToBreach also breached Sweden's e-government portal and "many other government agencies and high-profile companies" in the past year, but no corroborating sources are provided in the reference material.
Context: Romania joins Poland, Slovakia, Greece, Morocco, Russia, and Ukraine as countries whose land registry agencies have been hacked in the past three years, per the source.
4. Mitigation & containment
This incident targets a government agency, not client infrastructure directly. Mitigations below address both (a) clients' exposure to the ANCPI outage and (b) defensive lessons applicable to client environments.
P1 — within 24 hours
- Identify all business processes that depend on ANCPI registry data access (collateral verification, property valuation, mortgage origination, title insurance, KYC/AML property-source-of-funds checks). Document which are blocked or degraded.
- Assess whether any client systems integrate directly with ANCPI APIs or portals using credentials that may have been exposed in the stolen data. If credentials exist, rotate them immediately and audit access logs for anomalous activity since 1 July 2026.
- If client personnel have ANCPI system accounts, treat those credentials as potentially compromised (they were in the stolen dataset) and force password resets.
P2 — within 72 hours
- Review business continuity plans for extended registry outage scenarios (days to weeks). Establish manual workaround procedures for property transactions that cannot be completed electronically.
- For client environments, validate that backup strategy includes offline/immutable copies that survive an attacker with valid credentials and internal access. The ANCPI incident demonstrates that online backups were wiped but an offline copy enabled recovery.
- Review privileged-account monitoring: the ANCPI breach relied on valid credentials followed by internal mapping. Ensure EDR and SIEM rules flag credential reuse, unusual internal reconnaissance (e.g., AD queries, network scanning from authenticated sessions), and mass file deletion or backup service tampering.
P3 — within 7 days
- Conduct a tabletop exercise simulating destructive-wipe extortion failure: attacker has valid credentials, exfiltrates data, then wipes systems and online backups. Validate recovery time from offline backups and test ransom/extortion decision-making protocols.
- Review third-party dependency register for government registry and critical public-sector data providers. Document outage impact tolerances and alternative data sources.
- Monitor the hacking forum where ANCPI data was posted for any client-related credentials or documents appearing in follow-on sales.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, file paths) are present in the source material. The source describes the actor handle and doxxed identity but these are attribution claims, not technical IOCs.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Access using valid credentials followed by internal system mapping | SIEM: authentication logs showing successful login from unusual geography/time, followed by AD enumeration, network scanning, or SMB/share enumeration from the authenticated session | Medium — single-sourced from unnamed sources describing ANCPI attack |
| Mass data deletion or backup service tampering after failed extortion | EDR/SIEM: bulk file deletion commands, backup service stoppage, VSS shadow copy deletion, or storage array wipe events | Medium — source states systems and backups were wiped; mechanism unspecified |
| Stolen data posted for sale on hacking forum under "ByteToBreach" handle | Threat intel monitoring of known hacking forums; dark-web data-sale monitoring | Medium — single-sourced; forum not named in source |
6. Detection
Insufficient indicators to author detection rules. The source material does not contain specific file names, file paths, registry keys, mutex names, command-line strings, network signatures, or malware artefacts associated with this incident. The behavioural indicators in §5 are not amenable to YARA or Sigma rules without additional technical detail.
7. Sources
- Risky Business News, "Risky Bulletin: Hacker wipes Romania's entire land registry database," https://news.risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/, published 2026-07-20.
8. Adverse Trace position
This is a high-impact operational disruption event at a critical government registry, not a vulnerability disclosure or malware campaign. The attack chain — valid credentials, internal reconnaissance, extortion failure, destructive wipe — is a well-established pattern but the specifics here are single-sourced through Risky Business citing unnamed sources; confidence in technical detail is medium. Attribution to "ByteToBreach" / Zakaria Mahdjoub is unconfirmed (no MITRE ATT&CK profile; doxxing sourced to KELA alone). For EMEA financial services clients, the immediate risk is operational dependency on ANCPI data for property-related transactions in Romania; secondary risk is credential exposure if client staff held ANCPI accounts. We are monitoring for: (1) release of ANCPI stolen credentials on additional forums, (2) emergence of technical IOCs from Romanian CERT or law-enforcement disclosures, (3) confirmation of the offline backup recovery timeline, and (4) any spillover to other European land registry systems given the documented pattern of registry attacks across Poland, Slovakia, Greece, and Ukraine. Clients with Romanian property exposure should activate continuity plans now.
Published via PulseTrace — Adverse Trace threat intelligence.