Romania's Real Estate Market Freezes as Hackers Wipe Out National Land Registry Database

Romania is facing a digital nightmare. A hacker has reportedly wiped out the country's entire land registry database, bringing the real estate market to a standstill and leaving thousands of buyers facing massive financial losses just days before a major tax increase.

The attack targeted the National Agency for Cadaster and Land Registration (ANCPI). According to reports, the hacker gained access using valid credentials, then began deleting systems after an extortion attempt failed. The attacker boasted on the darknet of having manipulated online backups to make recovery impossible, and allegedly offered source codes and internal data for sale.

Because Romania's land registry and cadaster system is fully digitized, the consequences have been devastating. Property transactions are blocked nationwide. Notaries cannot authenticate sales. Banks are unable to issue mortgages. Ownership documents cannot be verified or issued. The country's real estate market has effectively ground to a halt.

The timing could not be worse. On August 1, 2026, Romania's VAT on new-build apartments is set to rise drastically from 9 percent to 21 percent. Thousands of transactions were carefully scheduled to close before that deadline. Now, with the registry offline, those deals are stuck. Buyers face the prospect of massive additional costs – or losing their deposits entirely.

Authorities initially dismissed the incident as a "technical problem" when it came to light in mid-July. The ANCPI has since been forced to confirm the cyberattack. Official apps and websites have remained offline. The agency claims to have offline backups and says it is working frantically to restore operations. But no timeline for normal functioning has been given. A spokesperson cautioned that information circulating in the public about the consequences "does not correspond to reality or the current state of the investigation."

The Romanian parliament has been convened for an emergency session. The Senate is now discussing an emergency ordinance to extend the VAT deadline, but whether it will pass in time remains unclear.

According to cybersecurity experts, the attacker is believed to operate under the darknet pseudonym "ByteToBreach" and is suspected to be operating from Algeria. Described as a "technically skilled cybercriminal" already known for attacks on government portals, the hacker apparently had an easy path into ANCPI's systems.

Romania's cybersecurity authority had repeatedly warned the agency about glaring security vulnerabilities. An analysis by the investigative platform "Public Record" revealed how easily the hacker gained access: active employee accounts with extremely weak and banal default passwords – including the stunningly insecure "passw0rd" – were found in the state agency's systems. Outdated operating systems and missing firewalls reportedly paved the way for the breach.

For now, Romania's property market is frozen. Buyers are panicking. Notaries are idle. And a country that prides itself on digitalization is learning a painful lesson about the cost of weak cybersecurity. The hacker may have deleted the data – but the passwords that made it possible were already a disaster waiting to happen.

Written by Thorben Thiede thorben.thiede@alpineweekly.com