🚨 Risky Bulletin: Romania's Land Registry Erased by Hacker

By Catalin Cimpanu | July 20, 2026 | ⏱️ 15 min read

This edition is sponsored by Thinkst, the creators of the highly regarded Thinkst Canary.

---

🇷🇴 The Great Romanian Land Wipe

A catastrophic security breach has struck Romania's cadastre agency, resulting in the complete deletion of the national land registry database. The destruction occurred after a failed attempt by the attacker to extort the agency.

The Impact

The fallout has effectively frozen the Romanian real estate sector. For over a week, official portals and applications have remained offline, leading to the following:

• Notaries: Unable to register any new property transactions.
• Citizens: Cannot access land records or obtain official proof of ownership.
• Communications: Email servers at the National Agency for Cadastre and Real Estate Advertising (ANCPI) were also knocked offline.

Attack Vector & Execution

According to sources, the breach followed a specific progression:

The incident became public on July 14. By July 15, stolen data—including internal network blueprints, employee credentials, and sensitive documents—appeared on a hacking forum.

While the attacker claimed to have destroyed all backups, the agency is currently rebuilding its network from scratch. It is widely believed that an offline backup existed; without one, the legal and economic chaos in Romania would be far more severe.

The Culprit: ByteToBreach

The data was leaked by a threat actor known as ByteToBreach, who previously targeted Sweden's e-government portal and various other high-profile entities.

While security firm KELA previously suspected the hacker was based in Algeria, they have since updated their profile to explicitly doxx the individual as Zakaria Mahdjoub, a resident of Oran, Algeria. This identification significantly streamlines the path for Romanian law enforcement.

Global Context: Romania is not alone. Over the last three years, land registries in the following nations have been targeted:

• Poland
• Slovakia
• Greece
• Morocco
• Russia
• Ukraine

---

🎙️ Seriously Risky Business Podcast

In the latest episode, Tom Uren and James Wilson explore the intersection of AI and ransomware. They highlight the group FulcrumSec, which utilizes basic breach techniques but employs Artificial Intelligence to increase their leverage during extortion negotiations with victims.

---

🛡️ Security Incident Roundup

🤖 Hugging Face & The AI Paradox

In a twist of irony, the AI platform Hugging Face was breached using an autonomous AI agent.

• The Method: The attacker exploited the data-processing pipeline to move laterally into internal systems.
• The Loss: Internal datasets and cloud credentials were stolen (though no customer data was leaked).
• The Irony: Hugging Face attempted to use a frontier AI model for incident response, but the model's safety guardrails blocked the analysis, unable to distinguish between a legitimate security investigation and an offensive attack. This forced the team to pivot to local models.

📉 Other Notable Breaches

---

🖼️ Gallery of Events