The editorial explicitly frames this as a wiper incident, not a ransomware negotiation. Ransomware operators want victims alive to pay, but wiper operators want the lights off — meaning defenders must design systems that make destruction expensive, not just recoverable via ransom payment.
The editorial argues the initial access vector 'almost doesn't matter' — what turned a bad week into a national crisis is that backups shared the same trust domain as production. Mounting backups on the same Active Directory domain and network fabric as production is a depressingly common pattern that collapses the entire recovery story when an attacker gets domain admin.
By submitting the Risky Business story, which centers on the destruction of both primary and backup systems, the submitter surfaces the core lesson: a national land registry lost not just its live database but also its recovery path. The 175-point score signals broad developer agreement that backup isolation is the operative failure here.
The editorial highlights that the fallout cascades far beyond ANCPI's servers: notaries can't complete transactions, banks can't confirm mortgage collateral, and every workflow depending on authoritative ownership records is stalled. With no public restoration timeline, this reframes the incident from a government IT problem into a nationwide freeze on property and credit markets.
Romania's National Agency for Cadastre and Land Registration (ANCPI) — the government body that records who owns what piece of land in the country — was hit by an attacker who didn't bother with the usual ransomware theater. According to Risky Business's reporting, the intruder wiped the production land registry database and then went after the backup systems, taking those out too. There is no ransom note being negotiated in the background because there is nothing to unlock. The data is gone.
The immediate operational fallout is what you'd expect when a country loses its authoritative record of property ownership: notaries can't complete transactions, banks can't confirm collateral on mortgages, and any workflow that depends on a live ANCPI lookup is stalled. ANCPI has acknowledged the outage and is working with Romanian cybersecurity authorities on recovery, but at time of writing there is no public timeline for when the registry will be fully restored, or from what.
This is not a ransomware story. It is a wiper story, and the two require completely different threat models. Ransomware operators want you alive so you can pay. Wiper operators want the lights off. Whether the motivation here turns out to be state-adjacent sabotage, a disgruntled insider, or a criminal crew that lost its cool doesn't change the operational reality: the defender's job is to make destruction expensive, and in this case it clearly wasn't.
The interesting part of this incident isn't the initial access — we still don't know how the attacker got in, and it almost doesn't matter. The interesting part is that the backups went down with the primary. That is the failure mode that separates a bad week from a national crisis, and it is depressingly common.
The pattern is well understood. Backups get mounted on the same Active Directory domain as production so that admins can restore with their normal credentials. Backup jobs run over the same network fabric as everything else. The backup appliance's management interface is reachable from any workstation with the right group membership. Once an attacker owns domain admin — which, in a mature intrusion, they will — the backup infrastructure is just another endpoint. If a single compromised credential can reach both your production data and the copies you'd use to restore it, you are running a single system with two names.
Compare this to how a serious backup posture actually looks. Immutable object storage with retention locks the operator themselves cannot override within the retention window. Backup credentials that live in a separate identity plane — a different tenant, a different directory, ideally a different vendor — with human-in-the-loop approval to delete or shorten retention. Air-gapped or tape copies for the crown-jewel datasets where the recovery point objective can tolerate a day of lag. None of this is exotic. AWS S3 Object Lock, Azure immutable blob storage, and every serious backup vendor from Veeam to Rubrik have shipped this for years. The technology exists; what's usually missing is the organizational willingness to treat the backup plane as a separate security domain instead of a folder on the file server.
Community reaction on Hacker News zeroed in on exactly this. The top-voted comments weren't about attribution or motive — they were engineers pointing out that any DR plan that hasn't been tested by actually pulling the plug on production is a theoretical DR plan. Several noted the specific irony that land registries are among the oldest continuous data stores in human civilization; European cadastres have paper records going back centuries, and now the digital successor system got zeroed out in an afternoon. There is a case to be made that some categories of data — deeds, birth records, court judgments — should retain a physical paper source of truth precisely because the digital copy is a single fragile artifact no matter how many replicas you keep.
The geopolitical read-across is worth naming even if the attribution is unclear. Romania is a NATO member on the alliance's eastern flank, and wiper attacks against Ukrainian government infrastructure have been a documented tool of the current war since 2022 — HermeticWiper, IsaacWiper, CaddyWiper, AcidRain, and a dozen others. That doesn't mean this incident is state-sponsored. It does mean the playbook is public, the tooling is commodity, and the threat model for any government IT shop in the region needs to assume a destructive adversary rather than a purely financial one.
If you run backups for anything anyone cares about, this week is a good week to answer three questions honestly.
First: can your production domain admin delete your backups? Not "is there a policy against it," not "is there an audit log." Can the credential technically do it? If yes, your backups are within the blast radius of your primary. Move retention enforcement into an identity plane that production cannot reach. On AWS, that looks like a separate account with an SCP that denies `s3:PutBucketVersioning`, `s3:BypassGovernanceRetention`, and lifecycle changes even to the root user. On-prem, it looks like a backup vendor whose immutability is enforced on the appliance itself, not on the file system your backup software writes to.
Second: when did you last restore from cold? Restoring a single file to prove the pipeline works is not a DR test. A DR test is standing up a working copy of the application from backups only, in an environment that has no network path to production, with the team that would actually do it under pressure. If the answer is "we did it during onboarding two years ago," you have unmeasured risk. The industry keeps re-learning that the backup you never restored is Schrödinger's backup — it's simultaneously fine and useless until you open the box.
Third: do you have offline copies of your crown jewels? For most applications, RPO of a few hours is fine and immutable cloud storage handles it. For the small set of datasets where a total wipe would be existential — customer PII you cannot re-derive, financial ledgers, compliance records, source code for a shipping product — a truly offline copy on media that is physically disconnected between writes is cheap insurance. Tape is not glamorous. Neither is a fire.
Romania will eventually rebuild the registry, probably from a mix of transactional logs held by notaries and banks, partial exports held by other agencies, and citizens showing up with paper deeds. It will be slow, expensive, and legally messy, and it will produce a definitive Romanian government report that other governments should read carefully. The uncomfortable truth for the rest of us is that most organizations are one motivated wiper away from the same conversation, and the fix isn't a product — it's the discipline to treat the recovery plane as a genuinely separate system that a fully compromised production environment cannot touch.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.