The National Cyberint Center on the attack against ANCPI: the institution had been warned since 2021, but it did not provide an official response

The National Cyberint Center (CNC) sent 1,304 notifications to public institutions between 2021 and 2026 regarding technical, procedural and human cybersecurity vulnerabilities. CNC chief Anton Rog told Parliament that the National Agency for Cadastre and Land Registration (ANCPI) had been warned as early as 2021 about critical vulnerabilities, before the cyberattack on July 14, 2026.

The ransomware attack, attributed to the ByteToBreach group, blocked the e-Terra platform and affected real estate transactions for nearly a month. Approximately 1,000 virtual servers in the ANCPI network were deleted. According to the CNC, the attack was facilitated by weak and reused passwords, including for administrator accounts, outdated systems and permissive access rules within the internal network.

DNSC Deputy Director Ionuț-Andrei Iacoboaei said it was not a highly sophisticated attack, but one based on known vulnerabilities. DNSC notified 2,400 public institutions about more than 40,000 vulnerabilities.

Anton Rog stated that, according to SRI data, ANCPI had not submitted an official response to the notifications it received. The institution’s representatives say that operations could resume fully next week and that there are no indications that the databases were affected. The parliamentary hearings raised questions about the protection of other public institutions.