ByteToBreach 2026 activity
Extortion group. 4 reports in 4 countries: 3 confirmed, 1 claimed or disputed. Latest 14 Jul 2026.
Romania · 
Nigeria · 
Sweden · 
Mexico
🎯 What sources say
- Romania: Claimed the ANCPI attack in July 2026; Romanian authorities call it an initial access broker. The Record
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ✅ ConfirmedNational Agency for Cadastre and Land Registration (ANCPI) | Romania | 14 Jul 2026 | Government | Intrusion | ByteToBreach | Confirmed. ANCPI called it the most serious technical incident in its history, and DNSC director Dan Cimpean said the attack was financially motivated with limited data exfiltrated. Claimed. ByteToBreach claimed the attack and advertised the data for sale. | The Record✓ 7 Nov |
 ⚠️ ClaimedSterling Bank | Nigeria | 27 Mar 2026 | Finance | Data leak | ByteToBreach | Response. The NDPC served notices on Sterling Bank and Remita on 1 April and opened a formal probe. Claimed. ByteToBreach claimed about 900,000 customer accounts and over 3,000 staff records, part of about 3TB taken with Remita data. | ITWeb Africa · WeeTracker✓ 8 Nov |
 ✅ ConfirmedCGI SverigeVia a vendor | Sweden | 13 Mar 2026 | Government | Data leak | ByteToBreach | Confirmed. CGI said two internal test servers in Sweden were accessed and an older application version and its source code were exposed. Civil defence minister Carl-Oskar Bohlin confirmed the leak and said CERT-SE and the NCSC were involved. Claimed. ByteToBreach said it leaked source code from e-government platforms used by Swedish agencies. | Cointelegraph✓ 8 Nov |
 ✅ ConfirmedUNAM | Mexico | 7 Jan 2026 | Education | Intrusion | ByteToBreach | Confirmed. UNAM confirmed an unauthorised intrusion into 5 of its roughly 100,000 systems over the holidays. It disabled them and said there was no sign that student or staff personal data was extracted. Claimed. A journalist reported the attacker, ByteToBreach, reached data on over 380,000 students and staff and confidential rector's office mail. | El Financiero · Xataka✓ 8 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology