A hacker wiped Romania's land registry with the password 'P@ssw0rd'
ANCPI, the agency that records who owns land in Romania, spent a week offline after a hacker who called itself ByteToBreach mapped its network, demanded a ransom, and wiped both the production database and its backups when the money didn't come. Only a backup kept outside the compromised network kept the country's property records from disappearing for good.
Security firm KELA has named the attacker as Zakaria Mahdjoub, working out of Oran, Algeria, the same actor blamed for breaching Sweden's e-government systems and land registries in five other countries within the past three years.
One HN commenter noted Algeria has an extradition treaty with Romania, an odd choice of target for someone hoping to stay unreachable.
ANCPI goes dark: a week without property transfers
Risky Business reports that Romania's National Agency for Cadastre and Real Estate Advertising, ANCPI, the agency that records who owns what land in the country, pulled its systems offline on July 14 after a hacker breached its network using valid, stolen credentials. The attacker mapped ANCPI's internal systems, exfiltrated employee logins and network documentation, then demanded a ransom. When ANCPI refused to pay, the attacker wiped the production database and the backups sitting alongside it. Notaries could not record a single sale, citizens could not pull ownership records, and even ANCPI's email servers went down with everything else.
The attacker has done this before, five times
Security firm KELA identified the intruder as Zakaria Mahdjoub, operating from Oran, Algeria under the handle ByteToBreach. The same actor previously breached Sweden's e-government infrastructure and, per risky.biz's reporting, land registries or government systems in Poland, Slovakia, Greece, Morocco, Russia, and Ukraine within the last three years. ANCPI says it is rebuilding from an offline backup kept in a separate location, targeting July 22 to finish migrating to Romania's Government Cloud, while a criminal investigation continues.
The thread's forensic correction: it wasn't sophistication, it was P@ssw0rd
In the discussion on Hacker News, the story shifted from how you defend against an attack like this to how it happened at all.
"Posts and screenshots apparently by the alleged attacker show 'P@ssw0rd' and other well-known / readily-guessable passwords from the hacked systems" — a commenter who tracked down the leaked-password screenshots
That detail reframes the incident. This wasn't a nation-state operation defeating hardened defenses: it was reused, guessable credentials on a system that stores the legal record of who owns Romania.
Why the disaster wasn't total
A commenter who works as a hardware verification engineer offered a reason the country isn't now facing a land-title crisis:
"The majority of people have paper documents from the land registry ... In the event that all the digital data or large parts if were lost it would be possible to reconstruct it from the papers" — a hardware verification engineer
Other commenters argued the deeper failure was architectural, not just human: a backup reachable from the same network the attacker already controlled was never really a backup, whatever ANCPI's statement about "multiple storage locations" implies. Several Romanian commenters pinned root cause elsewhere. One added:
"Romanian friends have told me that this is really due to corruption ... government gives IT/data contracts to cronies [who] don't actually do any real security work to protect the data" — a commenter relaying accounts from Romanian contacts
The next country doing this has less paper to fall back on
Six governments have had a registry gutted this way in three years, and each one still had paper records to lean on. Countries now digitizing land ownership for the first time, with no historical paper trail behind them, won't get ANCPI's second chance if the same failure, a guessable password sitting next to a reachable backup, happens again somewhere with nothing left to reconstruct from.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Anthropic's Product Chief Quit Figma's Board Days Before a Rival Launch
On April 14, Mike Krieger, Anthropic's chief product officer and an Instagram co-founder, quietly resigned from Figma's board. Three days later, Anthropic shipped Claude Design, a tool that let anyone generate the prototypes and pitch decks Figma had built its business on. Figma's stock dropped by the end of the day.