More
    HomeFeaturesAnalysisThe cyberattack on ANCPI: the real estate market standstill and the resulting...

    The cyberattack on ANCPI: the real estate market standstill and the resulting legal implications

    Published on

    Authors: Mihaela Ispas (counsel), Alexandra Ionescu (associate), Mihaela-Minodora Bănică (associate) – Filip & Company law firm

    On 14 July 2026, the National Agency for Cadastre and Property Registration (“ANCPI”) detected unauthorised access to its IT infrastructure. The technical investigation, led by the National Directorate for Cyber Security, confirmed a cyber-attack: the attackers had encrypted and deleted some of the servers on which the agency’s applications were running. The result was immediate – all ANCPI systems, from the e-Terra cadastre and land registry application to institutional email accounts, went offline.

    Initially, ANCPI announced that e-Terra would be back online on 19 July. Two weeks after the incident, however, the Government stated that technical teams were still working on rebuilding the infrastructure and restoring the application to working order, without being able to give a firm date. The good news, according to the authorities, is that the central database of the cadastral system – the one containing records of properties and real rights – was not affected.

    The effects were felt almost immediately, and various press articles have highlighted the economic impact of the disruption.

    Legal implications

    • Legal transactions affected

    Land registration plays an essential role in safeguarding civil transactions in Romania, ensuring enforceability against third parties and certainty of rights in rem over immovable property. This is regulated by Law no. 7/1996 on the Cadastre and Property Registration (“Law 7/1996”) and the Civil Code and is based on the registration of rights in rem in the land register. Under art. 35 of Law 7/1996, a notary public who authenticates a document by which a real right in immovable property is transferred, created, amended or extinguished has the obligation to request an extract from the land register for authentication purposes.

    Obtaining the land register extract for authentication purposes is therefore a mandatory legal obligation of the notary public. Article 46(2)(i) of Law 7/1996 classifies the drawing up of deeds transferring ownership without a land register extract as an administrative offence, which confirms that the legislature intended to make the conclusion of such deeds conditional upon the existence of the extract. In practice, the notary public will not proceed with the authentication without the land register extract.

    Since the authentic form is a condition of validity (ad validitatem) for the legal acts in question, the impossibility of obtaining the land register extract directly results in the impossibility of validly concluding them.

    For this reason, the impossibility of obtaining a land register extract for authentication affects the following real estate related legal operations:

    1. the conclusion of contracts transferring or creating real property rights, for which there is an ad validitatem condition requiring that they be concluded in authentic form: sale and purchase of real estate property (land, flats, commercial premises), real estate donations, real estate swaps and give-in-payment agreements involving a transfer of ownership, real estate mortgage agreements, the creation of real property rights (usufruct, superficies, easements, right of use, right of habitation), matrimonial agreements and voluntary partitions affecting real property rights, as well as merger or division proposals involving real estate. This also includes business transfer agreements involving the transfer of a de facto universality relating to the transferred business, which includes real estate assets;
    2. the conclusion of preliminary sale agreements governed by Law 207/2025 (also known in practice as the ‘Nordis Act’), relating to future individual dwellings or individual units in condominiums under construction, as the Act cumulatively requires authentic form ad validitatem, the recording of the building permit in the land register and the prior obtaining of the land register extract relating to the future unit;
    3. cadastral and property registration operations, such as registrations, provisional entries, annotations, cancellations from the land registers, the merger and de-merger of properties, as well as the acceptance of cadastral documentation;
    4. other notarial deeds dependent on the land register, even where the law requires only a land register extract for information purposes: deeds extinguishing real property rights, certificates of inheritance relating to properties registered in the land register, option agreements concerning real property rights, and deeds of adjudication in the context of property enforcement proceedings.

    Furthermore, neither consulting the register of owners nor obtaining land registry extracts for information purposes is possible during this period, which also affects real estate due diligence operations.

    • Legal transactions that remain available

    With regard to the categories of legal acts that may be validly concluded during the period of land register unavailability, we note the following:

    1. promissory sale agreements and promissory agreements for the creation of rights in rem, concluded under private signature (with the exception of those subject to the provisions of the Nordis Act and of promissory donation agreements), as these do not require authentic form ad validitatem and do not involve obtaining a land register extract; thus, promissory sale agreements may continue to be signed under private signature, with the parties to authenticate the final agreements once the integrated e-Terra IT application becomes operational again;
    2. lease agreements, regardless of their subject matter;
    3. mandates and powers of attorney (including those granted for the purpose of concluding future real estate transactions), the authentication of which is not conditional upon obtaining a land register extract;
    4. addenda to existing agreements, provided that these do not result in the transfer or creation of rights in rem.

    Essentially, any transaction for which registration in the land register is not mandatory and which does not require an extract from the land register may proceed as normal.

    Remedial and mitigation measures

    • Extension of the period during which buyers can benefit from reduced VAT

    One of the most pressing issues identified during this period of unavailability, however, concerns promissory sale agreements concluded before 1 August 2025, for which the final agreement was due to be concluded by 31 July 2026 in order to benefit from the reduced 9% VAT rate, instead of the standard 21% rate.

    As a measure to mitigate the impact, the Romanian Parliament voted on and sent for promulgation on 29 July 2026 a bill extending, up to and including 30 September 2026, the deadline by which homebuyers with promissory sale agreements concluded by 1 August 2025 can benefit from the reduced 9% VAT rate. The initiators’ argument was simple: without urgent intervention, thousands of bona fide buyers, who had complied with the legal framework, paid deposits and taken out mortgages, would have been penalised for a failure in the state’s infrastructure.

    However, the extension does not cover all dwellings, but only those with a usable floor area of up to 120 square metres and a value of no more than 600,000 lei, excluding VAT. The bill also provides for a mechanism to refund the VAT difference to those who completed their purchase between 1 August 2026 and the date the new law comes into force, with applications able to be submitted from 1 October 2026. It remains to be seen whether the law will be adopted in the same form by the Chamber of Deputies or whether it will suffer amendments.

    • Invoking force majeure

    A related legal issue that needs to be analysed in this context concerns the possibility for the parties to invoke force majeure as a contractual remedy in the event that the obligations arising from the promissory sale agreements, which were due to be concluded by 31 July 2026, can no longer be performed as a result of the institutional deadlock that has arisen, without this failure to perform being attributable to either of the contracting parties.

    From a legal perspective, there are sound arguments in favour of classifying this deadlock as a case of force majeure. The event is beyond the control of the parties; it is unforeseeable both in terms of its occurrence and its scale and duration; and its insurmountable nature stems from the absence of an alternative mechanism that would allow the final contract to be concluded. Such a classification would lead to the conclusion that we are faced with a temporary impossibility of performance, for which neither of the contracting parties is to blame.

    At the same time, the parties cannot resort to the conclusion of the contract by means of a court judgment serving in lieu of the contract. According to the Civil Code, an essential condition for bringing such an action is the existence of an unjustified refusal by the other party to conclude the promised contract. However, in the scenario under analysis, the failure to perform is not the result of such a refusal, but of a fortuitous impossibility of performance, which the Civil Code classifies as a justified cause for non-performance of contractual obligations.

    Although, according to the Civil Code, where the fortuitous impossibility of performance is temporary, performance of the obligation is suspended for a reasonable period, from a practical perspective we consider that, insofar as this is possible, the parties should enter into supplementary agreements to extend the contractual deadlines.

    Irrespective of this possibility, the party invoking unforeseeable impossibility of performance has a legal obligation to notify the other party of the existence of the event preventing the performance of the obligations undertaken. Consequently, in the event that the conclusion of the contract in authentic form is prevented by an institutional deadlock, any party relying on the existence of such an event to justify its failure to perform must notify the other party of this circumstance, within a reasonable timeframe from the moment it became aware or ought to have become aware of the impossibility to perform. Failure to comply with the notification obligation may give rise to liability for damage caused to the counterparty, as provided for in Article 1634(5) of the Civil Code.

    • Other remedies in practice

    In the absence of cadastral documents, the Agency for the Financing of Rural Investments has ordered the postponement until September of the funding rounds dedicated to young farmers and small farms. With regard to the open round in the field of green energy, the agency has adopted an emergency derogation: applicants are authorised to enter the value ‘0’ in the fields relating to cadastral data and to upload a sworn statement in place of the land register extract, with the obligation to submit the documents issued by ANCPI at a later stage of the assessment.

    Furthermore, as a measure to ease the tensions caused by this deadlock, the National Union of Notaries Public in Romania has publicly clarified that title deeds are not affected by a cyber-attack[1]. The authentic deed is drawn up in a single original copy, which is kept in physical form in the archives of the notary public who executed it, whilst only a duplicate is submitted to the land registry. A cyber incident does not ‘affect’ the original deed, as it is subject to permanent preservation in physical form.

    Conclusions

    The cyberattack on ANCPI represents an unprecedented incident that has affected the entire real estate transaction process in Romania. Beyond its cyber security implications, the incident highlights the legal system’s dependence on a centralised IT infrastructure and raises questions about the need to strengthen business continuity mechanisms and disaster recovery plans. The digitisation of real estate publicity has been a significant step forward, and safeguarding this progress requires proportionate investment in security, redundancy solutions to ensure services continue to operate at a minimum level, and appropriate emergency legislative measures.

    The measures adopted to date – the extension of the reduced VAT rate, the exemptions granted by AFIR and the clarifications provided by the National Union of Notaries Public – demonstrate that both the authorities and the professional community have taken action to mitigate the effects of the disruption. Nevertheless, the main takeaway remains the need to treat the state’s critical infrastructure with considerably higher standards of security and redundancy. The land register keeps track of Romania’s entire land holdings, and its security must be a strategic priority.

    At the same time, the disruption raises a number of complex legal questions that remain unresolved for the time being: what is the fate of legal documents already drawn up by notaries but which had not yet been registered in the land register at the time of the incident? What happens to registration applications currently being processed? What is the status of land register extracts issued previously for authentication purposes and which were still valid at the time of the disruption? The answers to these questions will depend, to a large extent, on the duration of the disruption and the solutions the authorities will adopt to restore the system’s full functionality.

    Latest articles

    Alexandru Petrescu, ASF: Structural reforms and strong fundamentals drive Bucharest Stock Exchange growth

    The recent performance of the Bucharest Stock Exchange (BVB) is supported not only by...

    SAMEDAY completes acquisition of Cargus, begins operational integration

    SAMEDAY has completed the acquisition of 100% of Cargus' share capital, following approval from...

    E.ON Romania installs over 1,200 residential solar systems, up 30 percent in H1 2026

    E.ON Energie România installed more than 1,200 residential photovoltaic (PV) systems during the first...

    ELCEN adds 30 MW to Romania’s National Power System by restarting Grozăvești CHP plant

    Electrocentrale București (ELCEN) announced that, starting Monday, the Grozăvești Combined Heat and Power (CHP)...

    More like this

    Alexandru Petrescu, ASF: Structural reforms and strong fundamentals drive Bucharest Stock Exchange growth

    The recent performance of the Bucharest Stock Exchange (BVB) is supported not only by...

    SAMEDAY completes acquisition of Cargus, begins operational integration

    SAMEDAY has completed the acquisition of 100% of Cargus' share capital, following approval from...

    E.ON Romania installs over 1,200 residential solar systems, up 30 percent in H1 2026

    E.ON Energie România installed more than 1,200 residential photovoltaic (PV) systems during the first...