![\"\"](\"https:\/\/www.roweb.ro\/blog\/wp-content\/uploads\/2026\/07\/cyber6.png\")
<\/a><\/p>\nOn 14 July 2026, the information systems operated by Romania\u2019s National Agency for Cadastre and Land Registration, ANCPI, became unavailable following a cyberattack. The disruption affected the e-Terra land registry application, institutional email services and the digital workflows used to register and process property-related requests.<\/p>\n
What followed showed how quickly a technical incident can become an economic and operational problem.<\/p>\n
Without access to land registry extracts and registration services, property transactions could not be completed. Notaries, developers, buyers, banks and public authorities all depended on systems they could no longer use. Because the process is largely digital, there was no simple offline alternative capable of absorbing the workload.<\/p>\n
The incident was described as the most extensive technical disruption in ANCPI\u2019s history. Romanian authorities stated that property data had not been compromised and that backups were available, while the circumstances of the attack remained under investigation. The affected applications were moved to the government cloud and subjected to additional security assessments before services could resume.<\/p>\n
The case offers a useful reminder for any organization that operates critical software: cybersecurity is not limited to protecting information from theft. It is also about keeping essential services available and restoring them safely when something goes wrong.<\/p>\n
<\/p>\n
A cyberattack can affect an entire business ecosystem<\/h2>\n
The direct target in this case was a public institution, but the consequences extended far beyond it.<\/p>\n
Land registry extracts and registration records are required for most property transactions in Romania. When these documents became unavailable, sales could not be finalized and new requests could not be processed. Delays then spread to related activities, including financing, permits, contractual deadlines and property development documentation.<\/p>\n
The timing added further pressure. The disruption occurred shortly before a tax deadline affecting certain residential purchases. According to Profit.ro, the difference generated by the VAT change could reach EUR 14,000 for an individual property. Buyers and developers already working under preliminary agreements faced administrative delays, possible contract amendments and additional financial uncertainty.<\/p>\n
This is a common pattern in major cybersecurity incidents. The cost is rarely confined to the affected servers. It can include:<\/p>\n
- \n
- interrupted operations and lost productivity;<\/li>\n
- contractual penalties or missed commercial deadlines;<\/li>\n
- delayed payments and transactions;<\/li>\n
- recovery and forensic investigation costs;<\/li>\n
- regulatory and legal exposure;<\/li>\n
- reputational damage;<\/li>\n
- loss of confidence among customers and partners.<\/li>\n<\/ul>\n
For systems connected to public services, finance, healthcare, real estate or utilities, availability is part of the service itself. If the platform cannot be accessed, the organization may be unable to perform its core function, even when the underlying data has not been permanently lost.<\/p>\n
![\"\"](\"https:\/\/www.roweb.ro\/blog\/wp-content\/uploads\/2026\/07\/cyber5.png\")
<\/a><\/p>\n<\/p>\n
Backups are essential, but they are not the whole recovery plan<\/h2>\n
ANCPI stated that it had backup copies that could be used to restore its data. This is an important safeguard, but the length and complexity of the disruption illustrate a broader point: having backups does not automatically guarantee rapid recovery.<\/p>\n
A usable recovery process depends on several questions:<\/p>\n
- \n
- Are backups isolated from the production environment?<\/li>\n
- Are they protected against unauthorized modification or deletion?<\/li>\n
- How frequently are they created?<\/li>\n
- When were they last restored in a controlled test?<\/li>\n
- How long would it take to rebuild the infrastructure?<\/li>\n
- Which applications must return first?<\/li>\n
- Can the organization verify that restored systems are clean before reconnecting them?<\/li>\n<\/ul>\n
If a backup is connected to the same environment and managed through the same compromised accounts, an attacker may be able to reach it. Even when the data remains intact, restoring a complex platform can take time. Servers, applications, identity systems, integrations and access rights must all be checked before operations restart.<\/p>\n
This is why business continuity and disaster recovery plans need to be tested, rather than stored as documents that are reviewed only after an incident. Recovery exercises reveal dependencies and technical gaps while there is still time to address them.<\/p>\n
View our Cybersecurity expertise<\/a><\/p>\n
![\"\"](\"https:\/\/www.roweb.ro\/blog\/wp-content\/uploads\/2026\/07\/cyber4.png\")
<\/a><\/p>\n<\/p>\n
Security testing must reflect real attack paths<\/h2>\n
Automated vulnerability scans are useful for identifying known weaknesses, outdated software and common configuration errors. They provide visibility, but they do not show the complete route an attacker might take through a system.<\/p>\n
A penetration test approaches the environment from the perspective of a real attacker. It examines whether separate weaknesses can be combined to gain unauthorized access, escalate privileges, move between systems or reach sensitive information.<\/p>\n
For an organization operating a critical application, testing should cover more than the public-facing platform. The scope may need to include:<\/p>\n
- \n
- web applications and APIs;<\/li>\n
- servers, networks and cloud infrastructure;<\/li>\n
- identity and access management;<\/li>\n
- administrative interfaces;<\/li>\n
- source code repositories and deployment pipelines;<\/li>\n
- third-party integrations;<\/li>\n
- remote access systems;<\/li>\n
- internal segmentation;<\/li>\n
- employee exposure to phishing and social engineering.<\/li>\n<\/ul>\n
The purpose is not simply to produce a list of findings. It is to understand which weaknesses create a realistic business risk and which ones should be fixed first.<\/p>\n
Our cybersecurity services combine penetration testing, vulnerability assessment, attack surface discovery and phishing simulations. This makes it possible to examine both the technical environment and the human entry points that attackers commonly exploit.<\/p>\n
Check out our Cybersecurity services<\/a><\/p>\n
![\"\"](\"https:\/\/www.roweb.ro\/blog\/wp-content\/uploads\/2026\/07\/cyber3.png\")
<\/a><\/p>\n<\/p>\n
Unknown assets create unmanaged risk<\/h2>\n
Organizations often secure the systems they know about while overlooking older applications, test environments, forgotten subdomains or services exposed during previous projects.<\/p>\n
These assets may still be connected to the company\u2019s infrastructure. They may contain outdated software, weak credentials or administrative interfaces that were never intended to be publicly accessible. Because they are no longer part of routine maintenance, they can remain vulnerable for long periods.<\/p>\n
Attack surface discovery helps identify what an external attacker can see. It maps domains, IP addresses, applications, services and other exposed assets, including systems that may not appear in the current IT inventory.<\/p>\n
For public institutions and companies with large digital environments, this visibility is particularly important. Infrastructure changes over time, teams use different tools and new services are introduced. A security assessment based on an incomplete asset list can provide a false sense of protection.<\/p>\n
Continuous discovery and monitoring allow security teams to detect these exposures before they become an entry point.<\/p>\n
<\/p>\n
Access should be limited before an account is compromised<\/h2>\n
Many serious incidents begin with a compromised account rather than an advanced technical exploit. Credentials may be obtained through phishing, password reuse, malware or an exposed service.<\/p>\n
Multi-factor authentication can reduce this risk, but it needs to be combined with tighter access controls. Users and applications should receive only the permissions required for their work. Privileged accounts should be separated from normal day-to-day accounts, monitored closely and reviewed regularly.<\/p>\n
Network segmentation also matters. If an attacker gains access to one workstation or application, they should not be able to move freely through the infrastructure. Critical databases, backup systems, source code repositories and administrative tools should be isolated and protected by separate controls.<\/p>\n
A useful security review therefore asks what happens after the initial breach. Can the attacker escalate privileges? Can they reach other systems? Can they disable backups or security tools? Can unusual activity be detected before the incident spreads?<\/p>\n
This is one of the areas where realistic penetration testing provides more useful information than a checklist-based audit.<\/p>\n
![\"\"](\"https:\/\/www.roweb.ro\/blog\/wp-content\/uploads\/2026\/07\/cyber2.png\")
<\/a><\/p>\n<\/p>\n
Detection speed changes the scale of an incident<\/h2>\n
Preventive controls will never eliminate every risk. Organizations also need the ability to identify abnormal activity and respond before it affects the wider environment.<\/p>\n
Logs from applications, servers, cloud platforms, authentication systems and network devices should be collected and correlated. Alerts need clear ownership, and the people receiving them must know what to do next.<\/p>\n
An incident response plan should define:<\/p>\n
- \n
- who coordinates the response;<\/li>\n
- how affected systems are isolated;<\/li>\n
- which internal and external parties must be informed;<\/li>\n
- how evidence is preserved;<\/li>\n
- how critical services are prioritized;<\/li>\n
- who has the authority to shut down or restore systems;<\/li>\n
- how communication is handled during the disruption.<\/li>\n<\/ul>\n
These decisions are difficult to make for the first time during an active attack. Tabletop exercises and technical simulations allow teams to test the process in advance and find unclear responsibilities or missing information.<\/p>\n
Roweb supports this work through security audits, automated assessments, security maturity planning and purple team operations. The aim is to connect prevention, detection and response instead of treating them as unrelated activities.<\/p>\n
<\/p>\n
Secure software requires continuous attention<\/h2>\n
Applications change. New features are released, dependencies are updated and integrations are added. A system that passed a security test last year may have a different risk profile today.<\/p>\n
Security therefore needs to be part of the development lifecycle. Static application security testing, dynamic testing and software composition analysis can help identify insecure code and vulnerable third-party components before they reach production.<\/p>\n
These tools are more effective when paired with secure coding practices and manual review. Automated checks can detect many known patterns, but they may miss flaws in business logic, authorization rules or complex workflows.<\/p>\n
Roweb integrates SAST, DAST and SCA tools into its security services and also provides secure coding training for development teams. This helps organizations address vulnerabilities during development, when they are generally easier and less expensive to fix.<\/p>\n
Assessments should also be repeated after major infrastructure changes, cloud migrations, new integrations or significant application releases. Migration can improve security, but changing the hosting environment alone does not remove vulnerabilities from the application, access model or operational process.<\/p>\n
Secure your software with our cybersecurity services<\/a><\/p>\n