Loading story…
Romania’s National Administration of Penitentiaries (ANP), which oversees the country’s prison system, was hit by a ransomware attack that affected multiple workstations and servers. Romanian media reported that the incident forced the institution to take several digital services offline as a precaution, while internal teams worked to contain the intrusion and prevent further spread across the network.
ANP notified Romania’s National Directorate for Cyber Security (DNSC), which joined the response effort to help limit the impact and support remediation. Public reporting indicates the attack disrupted administrative systems, but no threat actor, ransomware family, or technical indicators of compromise were disclosed at the time of reporting.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
ANP’s internal IT team notified Romania’s National Directorate for Cyber Security (DNSC) about the incident. DNSC then assisted with containment and efforts to reduce the attack’s impact.
Romania’s National Administration of Penitentiaries (ANP) was reportedly hit by a ransomware attack that compromised multiple workstations and servers. As a precaution, several critical digital services were taken offline to limit further spread.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romania's national water management agency, Administrația Națională Apele Române (Romanian Waters), suffered a significant ransomware attack that compromised around 1,000 systems, including servers, workstations, and critical IT infrastructure. The attackers used Microsoft's BitLocker, a legitimate Windows encryption tool, to lock files and left ransom notes demanding negotiations within seven days. Despite the widespread IT disruption, operational technologies such as dams and flood defenses remained unaffected, and hydrotechnical operations continued with staff relying on alternative communication methods like telephone and radio due to email outages. Authorities have not attributed the attack to a known ransomware group and have advised against negotiating with the attackers. The Romanian National Cyber Security Directorate (DNSC) confirmed that the attack impacted ten of the country's eleven river basin management organizations, but emphasized that water infrastructure operations were not disrupted. The use of BitLocker as a "living off the land" technique highlights a trend where attackers leverage built-in system tools to evade detection and complicate incident response. The DNSC reiterated its policy of not engaging with cyber extortionists and urged IT teams to focus on system restoration rather than external communications. The agency continues to investigate the incident and work towards full remediation of affected systems.
Jun 29, 2026
A **BackMyData** ransomware attack disrupted Romania's healthcare sector after attackers breached Bucharest-based software firm **RSC** and compromised its widely used **Hippocrates** hospital management platform. Romanian authorities said more than 100 hospitals were told to disconnect from the internet to contain the spread, while 26 hospitals were confirmed as directly infected. Because Hippocrates supported admissions, lab tests, radiology, medicines, supplies, payroll, pharmacy logistics, and test results, clinicians and administrators were forced to abandon digital systems and return to pen-and-paper and other offline workflows. The attackers encrypted files and demanded roughly **€160,000 in Bitcoin**, but Romanian officials instructed hospitals not to negotiate or pay. Most affected systems were restored within about five days using secure backups, though some data was permanently lost. The response by hospital staff, IT teams, and Romania’s national cyber authorities has since been cited as a notable example of healthcare incident response, emphasizing the value of network isolation, resilient backups, crisis communications, and rehearsed continuity plans.
Jun 29, 2026
Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT services and took its public website offline, while stating that operational technology (including pipeline control and telecommunications systems) remained functional and oil transport continued. The **Qilin** ransomware group claimed responsibility, and reporting indicated the actor alleged data theft on the order of **~1TB**, publishing purported proof such as internal documents, financial records, and scanned passports on its leak site. Separate reporting described an unrelated cloud-focused cybercrime campaign attributed to **TeamPCP** (aka **PCPcat** / **ShellForce**), which has been compromising exposed and misconfigured cloud management interfaces at scale using automated, worm-like propagation. The activity was assessed as leveraging broad scanning and “industrialized” use of known weaknesses and misconfigurations (rather than novel exploits) to hijack infrastructure and monetize access, with claims of at least **~60,000** servers compromised globally since late December.
Jun 29, 2026