Romania Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Romania
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Romania's cyber threat posture and 2026 incidents, checked 7 Nov 2026. Romania publishes no national cyber alert level; DNSC director Dan Cimpean and ministers describe the threat in public statements.
Source: The Record
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
| Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Cyberattacks on government institutions per day, per Defense Minister Radu Miruta | More than 10,000 | 2026 | The Record |
| Share of detected incidents linked to criminal actors, per DNSC | About 80% | As stated February 2026 | The Record |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Qilin | Ransomware | Claimed the Conpet attack in February 2026. | The Record | Profile |
| ByteToBreach | Extortion | Claimed the ANCPI attack in July 2026; Romanian authorities call it an initial access broker. | The Record | Profile |
Laws and rules this year
Full stories
Official statements
- 20 Jul 2026Dan Cimpean said the land registry attack was financially motivated and no land registry certificates were stolen. The Record
- 1 Apr 2026Defense Minister Radu Miruta said government institutions face more than 10,000 cyberattacks a day. The Record
- 23 Feb 2026DNSC head Dan Cimpean said ransomware attacks on critical infrastructure are likely part of a Russian hybrid operation. The Record
Incidents
2 of 2 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedNational Agency for Cadastre and Land Registration (ANCPI) | 14 Jul 2026 | Government | Intrusion | Confirmed. ANCPI called it the most serious technical incident in its history, and DNSC director Dan Cimpean said the attack was financially motivated with limited data exfiltrated. Claimed. ByteToBreach claimed the attack and advertised the data for sale. | The Record✓ 7 Nov | |
| ✅ ConfirmedConpet | 4 Feb 2026 | Energy | Ransomware | Confirmed. Conpet, the national oil pipeline operator, confirmed a cyberattack on parts of its IT and said oil transport and SCADA systems were not affected. Claimed. Qilin listed Conpet on its leak site and claimed nearly 1 TB of data. | The Record✓ 7 Nov |
FAQ
Does Romania have a national cyber threat level?
No published national cyber threat level was found for Romania's cyber threat posture and 2026 incidents (checked 7 Nov 2026). Romania publishes no national cyber alert level; DNSC director Dan Cimpean and ministers describe the threat in public statements.
Which organisations in Romania confirmed cyber incidents recently?
2 incidents confirmed since January 2026: National Agency for Cadastre and Land Registration (ANCPI) and Conpet.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.