Loading story…
Romania’s National Agency for Cadastre and Land Registration (ANCPI) confirmed that the outage affecting its e-Terra cadastre and land registry platform was caused by a cyberattack, disrupting property and real-estate transactions while the agency worked to restore services. ANCPI said the application would likely remain unavailable until the end of the week and stated that, based on its ongoing investigation, data managed through its IT systems had not been compromised.
At the same time, a threat actor using the alias ByteToBreach advertised alleged ANCPI data for sale on a dark web forum, claiming to have breached the agency’s internal network, stolen Romanian citizens’ cadastre and property records, copied GitLab servers and source code for core systems, and deployed ransomware. Those claims were not independently verified, but the actor has previously been profiled as a credible, opportunistic data-leak operator that targets high-impact organizations and monetizes stolen information through underground forums and public-facing channels.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ANCPI began migrating affected applications to the Romanian government cloud and said it would verify system integrity before gradually restoring services after the cyberattack. Romanian officials also said the intrusion appeared financially motivated and involved exploitation of known vulnerabilities and leaked credentials.
ANCPI confirmed that the outage affecting its e-Terra cadastre and land registry application was the result of a cyberattack, after initially describing the disruption as a major technical incident. The agency said its investigation was ongoing, stated that data under its administration had not been compromised, and warned the platform would likely remain unavailable until the end of the week.
A threat actor using the alias ByteToBreach posted a listing advertising data allegedly stolen from Romania’s National Agency for Cadastre and Land Registration (ANCPI), claiming compromise of the internal network, theft of citizen cadastre and property records, source code access, and ransomware deployment. The claims were reported as unverified.
According to the new report, ANCPI's breach became public on July 14 as an attacker allegedly began wiping the country's land registry database and backups after a failed extortion attempt. The incident reportedly disrupted ANCPI apps, websites, and email systems and halted parts of Romania's real-estate transaction process.
KELA assessed that the actor using the handle “ByteToBreach” had been active since at least June 2025, using multiple underground and public platforms to sell and leak stolen data from organizations in several sectors worldwide.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
news.risky.biz
Open sourcetherecord.media
Open sourcehelpnetsecurity.com
Open sourcedarkwebinformer.com
Open sourcekelacyber.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lithuanian prosecutors are investigating a major breach of the state registry systems after attackers used login credentials assigned to authorized institutions to access more than 600,000 records held by the Centre of Registers. The intrusion affected the Real Estate and Legal Entities Registers and exposed sensitive personal and property data, including names, dates of birth, national identification numbers, addresses, cadastral information, and registry numbers. Authorities said the breach was detected in early April, but disclosure was delayed while the criminal investigation proceeded, and the estimated financial damage exceeds **€111,000**. Lithuania has blocked suspected accounts and ordered credential changes as it works to contain the incident, while questions over the security of state IT systems intensified. Centre of Registers chief **Adrijus Jusas** resigned following the leak and said years of underinvestment had left government platforms in need of as much as **€60 million** in cybersecurity upgrades. Officials have not publicly attributed the attack or identified a responsible threat actor, despite political claims that the operation may show signs of foreign, possibly Russian, involvement.
Jun 29, 2026
France Titres, the French agency formerly known as ANTS and responsible for identity and registration documents, confirmed a breach of its `ants.gouv.fr` portal after threat actor **breach3d** advertised a trove of stolen records for sale on cybercrime forums. The agency said the compromised data may include login IDs, full names, email addresses, dates and places of birth, account identifiers, and in some cases postal addresses and phone numbers from both individual and professional accounts. Other reporting on the sale listings said the dataset could contain 18 million to 19 million records, including fields indicating government-verified identities, raising the risk of phishing, social engineering, and identity fraud if the claims are fully accurate. French authorities said unusual activity was identified in mid-April and launched parallel technical and judicial investigations involving **ANSSI**, **CNIL**, the Paris Public Prosecutor, and anti-cybercrime investigators. Prosecutors later announced the arrest of a 15-year-old suspect in connection with the case after records linked to the agency were allegedly offered for sale online, and said the inquiry covers unauthorized access, persistence, and extraction of personal data from a state-operated system. France Titres has notified affected individuals and said the stolen information does not provide direct access to user accounts or the portal itself, while warning citizens to remain alert for follow-on scams and impersonation attempts.
Jun 29, 2026
Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT services and took its public website offline, while stating that operational technology (including pipeline control and telecommunications systems) remained functional and oil transport continued. The **Qilin** ransomware group claimed responsibility, and reporting indicated the actor alleged data theft on the order of **~1TB**, publishing purported proof such as internal documents, financial records, and scanned passports on its leak site. Separate reporting described an unrelated cloud-focused cybercrime campaign attributed to **TeamPCP** (aka **PCPcat** / **ShellForce**), which has been compromising exposed and misconfigured cloud management interfaces at scale using automated, worm-like propagation. The activity was assessed as leveraging broad scanning and “industrialized” use of known weaknesses and misconfigurations (rather than novel exploits) to hijack infrastructure and monetize access, with claims of at least **~60,000** servers compromised globally since late December.
Jun 29, 2026