By ByteBot
On July 14, 2026, a hacker deleted Romania’s entire land registry database. Not just the production copy — the backups too. One offline copy survived. That copy is the only reason Romania’s property records still exist at all.
What Got Wiped
Romania’s National Agency for Cadastre and Real Estate Advertising (ANCPI) runs e-Terra, the system underpinning every property transaction in the country. On July 14, it went dark. By the time the attack was confirmed, the threat actor had wiped production databases, applications, email servers, and backup infrastructure. Six days later, systems remained offline.
The timing was brutal. Romania’s VAT on new residential properties jumps from 9% to 21% on August 1 — and thousands of buyers were racing to close transactions before that deadline. Those deals are now frozen. Notaries can’t record transactions. Citizens can’t obtain proof of ownership. An entire real estate market, serving roughly 150,000 to 170,000 home sales per year, came to a standstill because someone with a set of stolen credentials decided a failed extortion attempt was worth turning into a wiper attack.
The Attack: No Zero-Day Required
The threat actor, operating under the handle ByteToBreach, used stolen credentials to gain initial access. Not a zero-day. Not a sophisticated supply chain attack. Valid credentials — likely harvested through infostealers or phishing — were enough to reach ANCPI’s internal systems. Once in, the attacker mapped the environment, exfiltrated data including employee credentials, internal documents, GitLab repositories, source code for core systems, and citizen databases — then demanded payment. ANCPI refused. ByteToBreach wiped everything reachable.
Threat intelligence firm KELA assessed the actor to be Zakaria Mahdjoub, based in Oran, Algeria — an identification supported by infostealer artifacts, browser data, and consistent digital identifiers across platforms. ByteToBreach is not new: prior targets include Sweden’s e-government portal and dozens of government agencies across Ukraine, Kazakhstan, Cyprus, and the United States. Romania was not a fluke. It was a pattern.
The Backup That Saved Everything
Here is the part that matters for anyone who manages infrastructure: all production backups were also wiped. The attacker reached them through the same credential access used for production systems. Standard synchronized backups — the ones that feel thorough — were gone.
One copy survived: an offline backup, physically or logically isolated from the compromised credential set. That copy became the foundation for recovery. ANCPI announced migration to the government cloud, coordinated by the Special Telecommunications Service, with an estimated restoration date of July 22.
This is what the 3-2-1-1-0 backup rule looks like in practice: three copies, two media types, one offsite, one offline (airgapped), zero unverified. The “one offline” part is what saved Romania’s property records. Not the cloud replica. Not the synchronized secondary. The airgapped copy that probably felt redundant when someone argued for it in a meeting six months ago.
The Pattern Behind the Attack
Wiper attacks targeting government infrastructure are not declining in 2026. In March, attackers compromised Stryker’s device management platform and factory-reset over 200,000 systems globally within minutes. The Romania attack follows the same template: compromise admin credentials, achieve broad access, exfiltrate, demand, destroy when refused. What makes this template dangerous is that destroying data is simple and fast. Recovery is neither.
The credential entry point deserves emphasis. No one at ANCPI needed to click a phishing link on the day of the attack — credentials were likely harvested months earlier, quietly waiting. Multi-factor authentication on privileged access would not guarantee safety, but its absence meant the attacker faced no additional friction after acquiring valid passwords. That is a solvable problem.
What Infrastructure Teams Should Take from This
The practical checklist is short: backup accounts must not share admin credentials with production. Immutable or offline backups — write-once storage, S3 Object Lock, or physically disconnected media — must be part of the architecture, not an afterthought. Large-scale deletion events should trigger immediate alerts. Credential rotation and MFA on privileged access removes the most common entry vector entirely.
Business analyst Adrian Vascu put it plainly after the attack: “Digitalization quickly creates dependency, but it must also ensure trust.” Romania digitized its land registry. The backup that was probably the least glamorous piece of that infrastructure is the reason it still exists. Rescana’s technical post-mortem covers the full MITRE ATT&CK breakdown for teams that want the complete incident analysis.
