Loading story…
Romania's national water management agency, Administrația Națională Apele Române (Romanian Waters), suffered a significant ransomware attack that compromised around 1,000 systems, including servers, workstations, and critical IT infrastructure. The attackers used Microsoft's BitLocker, a legitimate Windows encryption tool, to lock files and left ransom notes demanding negotiations within seven days. Despite the widespread IT disruption, operational technologies such as dams and flood defenses remained unaffected, and hydrotechnical operations continued with staff relying on alternative communication methods like telephone and radio due to email outages. Authorities have not attributed the attack to a known ransomware group and have advised against negotiating with the attackers.
The Romanian National Cyber Security Directorate (DNSC) confirmed that the attack impacted ten of the country's eleven river basin management organizations, but emphasized that water infrastructure operations were not disrupted. The use of BitLocker as a "living off the land" technique highlights a trend where attackers leverage built-in system tools to evade detection and complicate incident response. The DNSC reiterated its policy of not engaging with cyber extortionists and urged IT teams to focus on system restoration rather than external communications. The agency continues to investigate the incident and work towards full remediation of affected systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Following the attack, authorities began efforts to connect Romanian Waters to Romania’s national critical infrastructure cyber protection and monitoring systems. Reporting said the agency had not been covered by that protection framework at the time of the incident.
By 2025-12-22, Romanian Waters publicly confirmed the cyberattack and stated that critical water operations continued without interruption despite widespread IT outages. Public reporting also noted that the initial intrusion vector and responsible actor were still unknown.
During the incident response, DNSC publicly advised Romanian Waters not to negotiate with the attackers. Officials focused on restoration and containment instead of engaging with the ransom demand.
Because email and other IT services were disrupted, staff switched to telephone and radio communications while hydrotechnical operations continued locally. Operational technology controlling dams, flood defenses, and water services was not affected.
Investigators determined the attackers used Microsoft BitLocker to encrypt files rather than custom ransomware tooling. A ransom note was left instructing the victim to make contact within seven days, though no group publicly claimed responsibility.
Romania’s National Cyber Security Directorate (DNSC) was notified of the incident on 2025-12-20 and began coordinating response and remediation efforts. Other national authorities, including intelligence and cyber response bodies, also joined the investigation.
On 2025-12-20, Romania’s National Water Administration (Romanian Waters) was hit by a ransomware attack affecting its central organization and 10 of 11 regional water basin administrations. About 1,000 IT systems were impacted, including servers, workstations, GIS, database, email, web, and DNS systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehackread.com
Open sourcedatabreaches.net
Open sourcetomshardware.com
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **BackMyData** ransomware attack disrupted Romania's healthcare sector after attackers breached Bucharest-based software firm **RSC** and compromised its widely used **Hippocrates** hospital management platform. Romanian authorities said more than 100 hospitals were told to disconnect from the internet to contain the spread, while 26 hospitals were confirmed as directly infected. Because Hippocrates supported admissions, lab tests, radiology, medicines, supplies, payroll, pharmacy logistics, and test results, clinicians and administrators were forced to abandon digital systems and return to pen-and-paper and other offline workflows. The attackers encrypted files and demanded roughly **€160,000 in Bitcoin**, but Romanian officials instructed hospitals not to negotiate or pay. Most affected systems were restored within about five days using secure backups, though some data was permanently lost. The response by hospital staff, IT teams, and Romania’s national cyber authorities has since been cited as a notable example of healthcare incident response, emphasizing the value of network isolation, resilient backups, crisis communications, and rehearsed continuity plans.
Jun 29, 2026
Oltenia Energy Complex, Romania's largest coal-based energy producer, suffered a ransomware attack attributed to the Gentlemen ransomware group. The incident, detected on December 26, resulted in the encryption of documents and files, and caused temporary unavailability of critical IT applications, including ERP systems, document management, email services, and the company website. Despite the disruption, the operation of the National Energy System was not jeopardized, and the company's activity was only partially affected. Upon discovery, the affected systems were isolated and IT teams began rebuilding infrastructure using existing backups. The company reported the incident to the National Cyber Security Directorate, the Ministry of Energy, and filed a criminal complaint with law enforcement agencies. Investigations are ongoing to determine the full impact and whether any data was exfiltrated prior to encryption. The Gentlemen ransomware group is known for exploiting compromised credentials and targeting internet-exposed services, deploying ransom notes and encrypting files with the `.7mtzhh` extension.
Jun 29, 2026
A ransomware attack on the Nevada state government was enabled by a state employee's accidental download of a trojanized system administration tool from a fraudulent website in May. The attackers established a backdoor, conducted lateral movement, and infiltrated the state's password vault server over several months. By August, they had exfiltrated sensitive data, deleted backup volumes, and deployed ransomware, disrupting services at more than 60 state agencies, including health benefits, public safety records, and DMV operations. The incident forced critical systems offline for up to 28 days, with recovery efforts requiring a full rebuild of Active Directory and significant overtime from IT staff. The state did not pay a ransom, and most recovery costs were covered by cyberinsurance, totaling at least $1.5 million. The after-action report from Nevada's technology office highlighted the attacker's use of search ads to distribute malware disguised as legitimate admin tools, a growing trend in initial access techniques. Despite the extensive impact, Nevada was commended for its accelerated response and transparency in reporting, restoring 90% of impacted data within a month. The incident underscores the risks of supply chain and user-driven compromises, as well as the importance of robust detection, backup, and identity management practices in defending against sophisticated ransomware campaigns targeting government infrastructure.
Jun 29, 2026