In July 2026, the Romanian national cadastre agency ANCPI suffered a ransomware attack attributed to the threat actor Bytetobreach. The attack was initially downplayed but later recognized by ANCPI as a major security breach. The threat actor uploaded stolen data to dark web forums, indicating a data compromise alongside ransomware activity. The incident was publicly confirmed by ANCPI through official press releases. No detailed technical information about the ransomware variant, infection vector, or exploited vulnerabilities is available from the provided sources.

The ransomware attack disrupted ANCPI's operations and resulted in unauthorized disclosure of data, as evidenced by data uploads on dark web forums. ANCPI described the incident as the most serious technical event in its history, implying significant operational and data security impact. There is no information on ransom payment, data recovery status, or further consequences.

No official patch or remediation details are available. As this is an incident involving ransomware on an organizational network, remediation would typically involve incident response actions such as isolating affected systems, restoring from backups, and enhancing network defenses. However, no vendor advisory or official fix is provided. Patch status is not yet confirmed — check ANCPI's official communications for current remediation guidance.