For a week, nobody in Romania could sell a house or sign a mortgage. Not because of a strike or a new law: because on July 14 an attacker wiped the entire country's land registry database, along with every backup he could reach. Nineteen million people depending on a question that security teams rarely ask and answer even less often: is there any copy left that the attacker couldn't get to? In Romania the answer was yes. Which is why this post lives in the "lessons" category and not the "catastrophes" one.
A week with a country's property market on hold
The timeline, as published by Risky Business and Help Net Security: on July 14, e-Terra —the cadastre and land registry system of ANCPI, Romania's national agency— goes down. On July 15, the agency confirms the cyberattack and, that same day, the stolen data shows up for sale on a forum. The attacker, going by ByteToBreach, claims to have taken citizen data, GitLab servers and the source code of the registry's systems. Meanwhile, in the physical world: notaries unable to authenticate sales, mortgages that can't be registered, citizens unable to prove their home is theirs.
On July 20, ANCPI announced it is rebuilding its entire network from scratch —"an extensive process of reinstallation and consolidation", in its own words— and that it expects e-Terra back by the end of the week. On the data there are two versions worth quoting as-is: the agency maintains that the information it administers "has not been compromised"; the attacker is selling what he claims to have stolen on a forum, and threat-intel firm KELA notes his previous claims turned out to be accurate. The investigation is ongoing; we won't be the ones to settle it from here.
The detail that changes everything: he wiped the backups too
According to the Risky Business bulletin, the attacker got in with valid credentials, wandered the internal network mapping systems, tried to extort the agency and, when that failed, wiped the systems and the backups. Read that again: the backups. It's not a plot hole, it's standard procedure. Nobody hoping to collect a ransom leaves your ability to restore intact. First they locate the copies, then they destroy them, and only then do they encrypt or wipe production. We've watched this play out in companies for years; now we've seen it at country scale.
And yet Romania is getting its data back. ANCPI itself explained why: backup copies stored across multiple locations prevented total loss. Put another way: at least one copy existed that the attacker's credentials couldn't reach. That copy —the boring one, the one that never shows up in the pretty architecture diagram, the one somebody kept beyond the reach of the compromised network— is the difference between "a very bad week" and a country rebuilding the ownership of millions of properties from paper deeds.
The rule this case engraves: if one set of admin credentials can wipe production and every one of your copies, you don't have three backups: you have one, with replicas. 3-2-1 isn't about counting copies; it's about making sure no single failure —human, technical or hostile— can reach them all.
Not Romanian bad luck: public registries are in the crosshairs
In January 2025, ransomware took down Slovakia's land registry (the UGKK office). Its government described it as the biggest cyberattack in the country's history, with a multi-million euro ransom on the table and a recovery estimated in weeks or months —partly because of doubts about whether the backups were complete. In May 2026, Lithuania's prosecutors confirmed someone had downloaded over 600,000 real-estate records from its Centre of Registers: no exploit involved, just legitimate credentials belonging to another public body with authorized access. Three countries, three attacks on the same kind of system in eighteen months —two of them without a single exploit—. That's no longer coincidence; it's a target category.
Why the fixation on land registries? Because they combine the three properties every extortionist looks for: they are the only copy of data that cannot be rebuilt from any other source, an entire country depends on them daily, and they usually run on public infrastructure with a smaller defense budget than a bank. Now translate that to your company: your ERP, your client records, your billing history. For your business, that system of which there is only one copy and without which you cannot operate is your land registry. The only difference is yours won't make the international press.
Valid credentials: the front door, again
Notice that Romania involved no zero-day, and neither did Lithuania: in both cases the attacker walked in the front door with real keys. A week ago we covered the opposite case, the SonicWall SMA 1000 zero-days, and the conclusion was the same as today's: the important question isn't "can they get in?" —sometimes the answer will be yes, via exploit or stolen credential— but "what can they reach once inside?". When the answer includes "the backups", the incident stops being a technical problem and becomes an existential one.
How to build the copy that survives
In the backups we manage —with Proxmox Backup Server and with Veeam, depending on the client's platform— we apply a rule this case illustrates better than any slide deck: design the backup assuming the attacker already holds the admin credentials. Everything that actually matters follows from that:
- 1.Real immutability. At least one copy on storage where nobody —not a legitimate admin in a hurry, not an attacker holding his credentials— can delete or modify it before its retention expires. If it can be switched off with one click from the same console, it isn't immutable: it's decorative.
- 2.Separate credentials. The backup system doesn't join the domain it protects, and its credentials are shared with nothing else. The day Active Directory falls —which is exactly the day the backup exists for— the backup infrastructure must remain hostile territory for the attacker.
- 3.Genuine physical or logical distance. The Romanian copy that survived did so by being beyond the compromised network's reach. Whether you achieve that with an offline location, another datacenter or storage detached from the domain doesn't matter: what counts is that no administrable network path leads from production to that copy.
- 4.Restoring is rehearsed. Romania had the copy and has still spent over a week rebuilding. A backup you've never restored at scale is a hypothesis, not a plan. Recovery time is measured by rehearsing it, not estimated in a meeting.
On that last point, be careful not to read the Romanian case as a clean win: the copy existed, yet the country spent a week without a property market and the agency chose to rebuild its entire network from scratch —a sensible call when an intruder roamed around with valid credentials, and a brutally expensive one in time—. Having the data is not having the service. That distance between "the data is safe" and "we're operating again" is exactly what we mean when we talk about disaster recovery, and what our analysis of the AWS CloudFront outage was about last week.
The two questions for this week
If you take one thing from this case into your next IT meeting, make it these two questions. One: how many of our copies could someone delete if they obtained our admin's credentials? If the answer is "all of them" —and in more companies than you'd think, it is—, the rest of your security strategy is built on that crack. And two: when did we last restore something genuinely big, and how long did it take? If nobody can answer, the missing data point isn't technical: it's that it has never been done. At everyWAN we run backup as a managed service precisely around those two questions: immutable copies with separate credentials and location, and restores that get tested rather than assumed. If you want us to go through both answers with you, let's talk.
In short
Romania wasn't saved by a firewall, a SOC, or a box with blinking lights. It was saved by the copy the attacker couldn't touch. Everything else —perimeter, detection, response— exists so that hopefully you never need it; but the last link in your continuity is exactly that: an intact copy and the demonstrated ability to come back from it. An entire country just found out which of its IT investments was actually worth it. Better to find out in a drill than on the news.
Sources (verified): ANCPI attack timeline, entry with valid credentials, failed extortion and wiping of systems and backups — Risky Business News; attack confirmation (Jul 15), ByteToBreach's claims, KELA's assessment, ANCPI statements (backups in multiple locations, network rebuild, Jul 20) — Help Net Security; ransomware against Slovakia's registry (UGKK, January 2025), called the biggest cyberattack in the country's history — The Record and Infosecurity Magazine; theft of over 600,000 records from Lithuania's Centre of Registers using legitimate credentials (May 2026) — The Record.
Would your backups survive a hostile admin?
At everyWAN we've been maintaining business infrastructure since 1996, and the backups we manage today are immutable, with separate credentials, and with restores that actually get tested. The question isn't whether you have backups; it's whether any would be left standing the day someone walks in with your keys.
Talk to everyWAN
Microsoft 365
ES 
CAT 
EN