As I write this, you still cannot legally buy or sell a home in Romania. Not because of the market - because the National Agency for Cadastre and Land Registration (ANCPI) has been hacked, its e-Terra land registry is down, and notaries have no way to register a transaction or issue proof of ownership. It has been like this for more than a week. The timing is cruel: the reduced 9% VAT rate on qualifying homes expires on 1 August, and real-estate developers warn that missing the window could cost a single family up to 72,000 lei.
Here is the part that should bother every engineer and every public official. The head of Romania's own National Cyber Security Directorate (DNSC), Dan Cîmpean, said the attack "was not complex and could have been prevented," and that the attacker exploited "vulnerabilities that we had notified them about quite recently."
That is not the story of a sophisticated adversary. It is the story of a predictable one - and predictable is worse, because predictable means preventable.
What we actually know
The public timeline is straightforward. On 14 July, e-Terra went dark and was first described as a "technical incident." Within a day it was confirmed as a cyberattack. A financially motivated actor using the handle "ByteToBreach" posted screenshots on a cybercrime forum, put data up for sale, copied ANCPI's GitLab repositories and their source code, and deployed ransomware. Public reporting is consistent that the intrusion was facilitated by valid credentials - the attacker even left a note to the effect that the hope was that one of the cracked passwords would work.
ANCPI maintains that citizen data was not compromised and that no ransom was paid; the attacker claims otherwise and advertised data for sale. Those two claims will take time to reconcile, and I would not treat either as settled yet. But one fact is not in dispute and it is the most important one: ANCPI is recovering at all only because some backups were kept offline, in more than one location. The agency has started moving its applications into the Government Cloud, under the STS - but as I write, the service is still not fully back.
I am not going to reproduce the internal details the attacker dumped. They are already circulating, and reprinting IP addresses, credentials, or the names of staff only helps the next attacker and re-victimises people who were just doing their jobs. The useful part - the lessons - does not need any of it.
Why it was easy: the anatomy of a "traditional" attack
One security expert quoted in the coverage described it precisely: an internet-facing system had a known vulnerability, it was exploited, the attacker reached the internal network, and from there saw all systems and services and eventually the important data. That single sentence contains four separate failures. They are worth pulling apart, because they are the same four failures in almost every breach of this shape.
1. The front door was internet-facing legacy that nobody patched. A known vulnerability on an internet-exposed system is the classic entry point. The generation of Java-era enterprise middleware and on-prem identity servers that public institutions still run is exposed by design, carries a long tail of published remote-code-execution CVEs, and gets patched slowly precisely because it is "too critical to touch." An internet-facing service you are afraid to patch is not an asset. It is a liability with a countdown timer.
2. Valid, reused credentials turned a foothold into the keys. Stolen and reused credentials are the leading breach vector across the whole industry, not just here. When the same administrative password opens more than one system, a single leak stops being an incident and becomes lateral movement. This is exactly what a tiered admin model, a real password manager or PAM, and phishing-resistant MFA exist to stop.
3. The network was flat. "From there the attacker saw all systems." That is the signature of a network with no meaningful internal segmentation. Segmentation is the difference between one compromised server and a guided tour of the entire estate.
4. The crown jewels - virtualisation and backups - were in reach. This is the part engineers consistently underweight. Whoever controls the hypervisor controls every virtual machine on it, including the domain controllers. Whoever controls the backup system controls whether you can recover at all. If those planes share credentials with ordinary servers and sit on the same flat network, "compromise one box" quietly becomes "compromise everything, then try to delete it." ANCPI survived that last step only because some backups were offline. That was not sophistication. It was the one good decision that happened to still be standing when the attacker arrived.
The real root cause is a number: 0.2%
Strip away the technical detail and you reach the actual cause. Over roughly two decades, ANCPI reportedly spent about 1.6 million lei (around €305,000) on cybersecurity - 0.2% of a roughly 710 million lei (€135 million) digitalisation programme (the figures are from Ziarul Financiar). Read that ratio again: for every 500 lei spent making the system bigger and more central to daily life, roughly one leu went to defending it. And the specific weaknesses had been flagged in advance.
That is not a technical failure. It is a governance and prioritisation failure. Security was treated as an optional line item on a system that had quietly become critical national infrastructure - the ledger of who owns what in an entire country.
This is not just ANCPI
It would be comforting to call this an outlier. It is not. Two days later, the Ministry of Investments and European Projects was hit. In December, Romanian Waters was ransomwared across roughly a thousand systems. Romanian public institutions reportedly absorb more than 10,000 attack attempts a day. ANCPI is simply the one that made the news, because it froze the property market. The large, soft estate of legacy on-prem systems across the public sector is a target-rich environment, and attackers have clearly noticed.
What actually defends against this
I build automation and identity on the Microsoft stack for a living, so I will be concrete - but none of this is exotic, and the principles are vendor-neutral:
- Identity first. Phishing-resistant MFA everywhere. A tiered admin model with privileged access workstations, so a domain-admin credential never lands on an everyday machine. Unique, rotating local-admin passwords. And no credential reuse across tiers. Legacy on-prem identity you cannot safely patch is exactly what modern cloud identity is for - this is where Microsoft 365 and Azure consulting around Entra ID conditional access, Privileged Identity Management, and Identity Protection earns its cost many times over.
- Segment the network, and treat management planes as tier 0. The hypervisor, the backup system, and the domain controllers are the crown jewels. They get their own isolated segment, their own credentials, and their own MFA - and they are never reachable from a compromised application server.
- Immutable, offline backups - by design, not by luck. ANCPI survived because some backups were offline. Make that the plan, not the accident: immutable and offline copies, restores you actually test, and the working assumption that the attacker will try to delete your backups first.
- Patch what faces the internet, and act on the warnings you are given. The DNSC says it had flagged these vulnerabilities. A vulnerability you have been told about and have not fixed is no longer a risk. It is a decision.
- Assume breach. Zero Trust is not a product you buy; it is the posture of assuming any single component is already compromised and ruthlessly limiting what that buys the attacker. A short, honest automation and security audit that maps exactly this - identity, segmentation, backups, exposure - is far cheaper than a week of national paralysis.
The uncomfortable takeaway
Almost none of these fixes are expensive or exotic relative to a €135 million programme. Segmentation, MFA, patching, offline backups, not reusing passwords - this is the boring, well-documented core of the job. The gap at ANCPI was not capability, and it was not really money in the absolute sense. It was prioritisation: for twenty years, a national land registry was funded for defence like a brochure website.
The breach was preventable. So is the next one. The only real question is whether the institutions holding our most important data choose to prevent it before the headline - or after.
