Risky Bulletin: Hacker wipes Romania's entire land registry database
A hacker has breached Romania's cadastre agency and wiped the country's entire land registry database following a failed extortion attempt.
The hack has brought Romania's entire real-estate market to a standstill as official apps and websites have been offline for a week. Notaries can't record new transactions while citizens can't obtain proof of ownership or detailed land records.
Email servers at the National Agency for Cadastre and Real Estate Advertising ( Agenția Națională de Cadastru și Publicitate Imobiliară, or ANCPI) were also down as part of the incident.
Sources told Risky Business that the hacker entered using valid credentials, mapped internal systems, and wiped systems and backups after failing to extort the agency.
The incident became public on July 14 as the hacker started deleting data. A day later, some of ANCPI's stolen data was put up for sale on a known hacking forum. The posted data included employee credentials, internal documents, and details on the agency's IT network.
Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania.
The stolen data was posted online by an account with the name ByteToBreach, a known hacker who also breached Sweden's e-government portal this year, and many other government agencies and high-profile companies over the past year.
Security firm KELA published a profile on ByteToBreach last December and hinted they might be located in Algeria, but since the ANCPI hack has updated the post and outright doxxed the hacker as Zakaria Mahdjoub, an individual from Oran, Algeria.
Well, that will make the job of Romanian law enforcement a hell lot easier! gj!
Romania joins Poland, Slovakia, Greece, Morocco, Russia, and Ukraine as countries that had their land registry agencies hacked over the past three years.
