Romania's **National Agency for Cadastre and Land Registration (ANCPI)** announced Monday that a recent cyberattack, which disabled the country's digital registry systems last week, did not compromise its core technical and legal databases. These crucial records contain cadastral information, including property boundaries and maps, as well as legal data such as ownership and mortgages. **ANCPI** is actively working to restore services, which have been offline for nearly a week, effectively halting real estate transactions nationwide. The agency has initiated the migration of its applications to the Romanian government cloud, with full restoration expected after integrity verification. "The primary objective is to protect data integrity and eliminate all identified vulnerabilities," **ANCPI** stated, emphasizing that affected systems will remain isolated until all security weaknesses are addressed. Last Tuesday, the agency described the incident as "the most serious technical incident in the institution's history." The cyberattack disabled its central IT infrastructure, including the nationwide **e-Terra** cadastral and land registry platform. The outage has severely disrupted online land registry services, official email systems, and applications used by notaries, lawyers, cadastral specialists, and **ANCPI** employees. This prevents authorities from registering new property transactions or processing existing requests. **Dan Cimpean**, director of Romania's **National Directorate for Cyber Security (DNSC)**, told Romanian outlet G4Media that the attack appeared to be financially motivated. It was carried out by exploiting known software vulnerabilities, which authorities had recently warned organizations to patch, in conjunction with previously leaked credentials. "It wasn't a very complex attack," Cimpean said. Investigators have found no evidence of stolen personal data or land registry certificates, though a limited amount of information, including user credentials and application source code, was allegedly exfiltrated. A threat actor identifying as **ByteToBreach** claimed responsibility for the attack last week, advertising what it alleged was stolen **ANCPI** data for sale on an underground forum. This included internal databases and source code for the **e-Terra** system. Cimpean indicated that Romanian authorities believe **ByteToBreach** is an initial access broker targeting poorly protected systems for financial gain, rather than a state-backed hacking group. Investigators suspect the threat actor is based in Algeria. Israel-based cybersecurity firm **Kela** has attributed the **ByteToBreach** persona to **Zakaria Mahdjoub**, an alleged cybercriminal based in Oran, Algeria. **Kela** describes him as a prolific seller of stolen government, banking, and airline data. Romanian authorities have not independently verified these claims. In an interview with Euronews Romania, conducted via the Signal messaging app, a person claiming to be the hacker apologized to Romanians and IT professionals for the intrusion. When asked about citizen concerns regarding stolen data, the individual replied: "I don't sell this data to just anyone." Recorded Future News could not independently verify the identity or the claim. Local media reports highlight that this disruption comes just weeks before Romania plans to increase the value-added tax on new homes from 9% to 21%. This incident is reportedly delaying transactions that many buyers and developers had hoped to finalize before the higher tax takes effect. Given that the country's cadastral and land registry system is entirely digital, authorities are currently unable to register new property transactions, process existing applications, or issue land registry extracts essential for home sales and mortgage registrations.