Loading story…
Lithuanian prosecutors are investigating a major breach of the state registry systems after attackers used login credentials assigned to authorized institutions to access more than 600,000 records held by the Centre of Registers. The intrusion affected the Real Estate and Legal Entities Registers and exposed sensitive personal and property data, including names, dates of birth, national identification numbers, addresses, cadastral information, and registry numbers. Authorities said the breach was detected in early April, but disclosure was delayed while the criminal investigation proceeded, and the estimated financial damage exceeds €111,000.
Lithuania has blocked suspected accounts and ordered credential changes as it works to contain the incident, while questions over the security of state IT systems intensified. Centre of Registers chief Adrijus Jusas resigned following the leak and said years of underinvestment had left government platforms in need of as much as €60 million in cybersecurity upgrades. Officials have not publicly attributed the attack or identified a responsible threat actor, despite political claims that the operation may show signs of foreign, possibly Russian, involvement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Centre of Registers chief Adrijus Jusas resigned amid scrutiny over the major data leak. He said years of underinvestment had left state IT systems needing up to €60 million in cybersecurity upgrades.
Prosecutors began investigating the major breach of the country's state registry systems involving the theft of more than 600,000 records from the Centre of Registers. Officials said the attackers had exploited credentials belonging to authorized institutions.
In response to the breach, Lithuania blocked suspected accounts and required credential changes for affected access holders. Authorities also estimated the financial damage from the incident at more than €111,000.
Officials detected the breach in early April after unauthorized access to state registry systems was identified. Public disclosure was delayed while a criminal investigation proceeded.
A foreign actor abused login credentials assigned to authorized institutions to access the Centre of Registers' Real Estate and Legal Entities Registers. The theft exposed more than 600,000 records containing personal and property information, including names, dates of birth, national ID numbers, addresses, cadastral data, and registry numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romania’s National Agency for Cadastre and Land Registration (**ANCPI**) confirmed that the outage affecting its `e-Terra` cadastre and land registry platform was caused by a cyberattack, disrupting property and real-estate transactions while the agency worked to restore services. ANCPI said the application would likely remain unavailable until the end of the week and stated that, based on its ongoing investigation, data managed through its IT systems had not been compromised. At the same time, a threat actor using the alias **ByteToBreach** advertised alleged ANCPI data for sale on a dark web forum, claiming to have breached the agency’s internal network, stolen Romanian citizens’ cadastre and property records, copied `GitLab` servers and source code for core systems, and deployed ransomware. Those claims were not independently verified, but the actor has previously been profiled as a credible, opportunistic data-leak operator that targets high-impact organizations and monetizes stolen information through underground forums and public-facing channels.
Jul 20, 2026
Spain’s **Ministry of Science, Innovation and Universities** partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias **GordonFreeman** claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical **IDOR** flaw to obtain valid credentials. Separately, Spain’s **Ministry of Finance (Ministerio de Hacienda y Función Pública)** faced an unverified data-breach claim from a threat actor calling themselves **HaciendaSec**, who advertised alleged access to data on **~47.3 million** citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s **National Cryptologic Centre (CCN)**, stated it found **no evidence** of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s **La Sapienza** university following a suspected ransomware attack.
Jun 29, 2026
Armenian authorities opened an investigation after a threat actor using the alias **dk0m** advertised for sale a dataset allegedly containing nearly **8 million** government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for **$2,500** and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s **government email infrastructure** had been breached while acknowledging the possibility that another state platform was accessed. Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the **electronic civil litigation** platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at **CyberHUB-AM** assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses **infostealer malware** to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to **August 2024** were cited as supporting evidence. The alleged exposure could increase **social engineering** risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.
Jun 29, 2026