When Romania’s National Agency for Cadastre and Land Registration (ANCPI) was hit by a cyberattack that disrupted the country’s property registry systems, the reaction followed a script that has become increasingly familiar.
A major institution goes offline. Panic spreads. Social media fills with speculation. Political rhetoric quickly shifts toward Russia.
Only afterwards do investigators begin sorting out what actually happened.
This time, the evidence appears to tell a very different story.
Another Major Romanian Institution Goes Offline
ANCPI is hardly an obscure government agency. It manages Romania’s national cadastre and land registry, maintaining the official records behind property ownership, land registration and cadastral maps.
When its e-Terra platform became unavailable, the disruption was felt across the real estate sector. Notaries, surveyors, public institutions and citizens suddenly found themselves unable to access services that underpin property transactions throughout the country.
ANCPI later confirmed that the outage was the result of a cyberattack rather than a technical malfunction.
Russia Once Again Entered the Conversation
If there is one constant in Romania’s public debate over cyber incidents, it is how quickly fingers point east.
President Nicușor Dan publicly condemned Russia over hostile cyber operations targeting European Union and NATO member states, reaffirming Romania’s support for coordinated sanctions against those responsible.
Against that backdrop, it did not take long for speculation surrounding the ANCPI attack to drift toward Moscow. For many observers, another cyber incident automatically meant another Russian operation.
It has become something of a reflex. Unfortunately, cyber forensics does not work on reflexes.
Then Came ByteToBreach
As investigators continued their work, an entirely different picture began to emerge.
Responsibility was claimed by an individual using the alias ByteToBreach, who described the attack as financially motivated rather than political.
In interviews with Romanian media, the hacker said the objective was money, not espionage or sabotage. He even apologised to Romanian citizens and ANCPI’s IT staff for the disruption, claiming he had exploited a known software vulnerability rather than an undiscovered zero-day.
Romanian authorities have also indicated that the individual behind the alias is believed to be of Algerian origin, although the person’s identity has not been officially confirmed.
None of this resembles the sophisticated state-backed cyber operation that many initially assumed.
Conflicting Claims Remain
That does not mean every claim made by the attacker should be accepted as fact.
ByteToBreach alleges that data was extracted from ANCPI’s systems and has reportedly attempted to sell the information online.
ANCPI, however, maintains that its databases remain secure and that the integrity of official land registry records has not been compromised.
Romania’s National Cyber Security Directorate has likewise stated that investigators have not identified evidence showing that citizens’ personal data was stolen.
The investigation remains ongoing, and several technical questions have yet to receive definitive answers.
Evidence Before Politics
None of this is to suggest that Russia does not conduct cyber operations against European countries. It does, and Romania has been among the states warning about that threat.
But there is an important distinction between recognising a genuine geopolitical risk and assuming every cyber incident must be another Kremlin operation.
The ANCPI attack is a useful reminder that not every hacker wears a military uniform or answers to an intelligence agency. Sometimes the culprit is simply a criminal looking for profit.
Cybersecurity investigations depend on evidence, not instinct.
If there is one lesson from the ANCPI case, it is that attributing responsibility before the facts are established helps nobody. The headlines may come faster, but the truth usually takes a little longer.
