Hacker wipes Romania's land registry database

This newsletter is brought to you by Thinkst , the makers of the much-loved Thinkst Canary . You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed . You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here .

A hacker has breached Romania's cadastre agency and wiped the country's entire land registry database following a failed extortion attempt.

The hack has brought Romania's entire real-estate market to a standstill as official apps and websites have been offline for a week. Notaries can't record new transactions while citizens can't obtain proof of ownership or detailed land records.

Email servers at the National Agency for Cadastre and Real Estate Advertising ( Agenția Națională de Cadastru și Publicitate Imobiliară , or ANCPI) were also down as part of the incident.

Sources told Risky Business that the hacker entered using valid credentials, mapped internal systems, and wiped systems and backups after failing to extort the agency.

The incident became public on July 14 as the hacker started deleting data. A day later, some of ANCPI's stolen data was put up for sale on a known hacking forum. The posted data included employee credentials, internal documents, and details on the agency's IT network.

Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania.

The stolen data was posted online by an account with the name ByteToBreach , a known hacker who also breached Sweden's e-government portal this year, and many other government agencies and high-profile companies over the past year.

Security firm KELA published a profile on ByteToBreach last December and hinted they might be located in Algeria, but since the ANCPI hack has updated the post and outright doxxed the hacker as Zakaria Mahdjoub , an individual from Oran, Algeria.

Well, that will make the job of Romanian law enforcement a hell lot easier! gj!

Romania joins Poland , Slovakia , Greece , Morocco , Russia , and Ukraine as countries that had their land registry agencies hacked over the past three years.

In this edition of Seriously Risky Business , Tom Uren and James Wilson talk about different ways ransomware groups are taking advantage of AI. The relatively new FulcrumSec group uses simple techniques to breach companies and then uses AI to get more leverage over victims in its extortion negotiations.

Hugging Face hacked using AI: A threat actor used an autonomous AI agent to breach AI platform Hugging Face last week. The attacker used exploits in the platform's data-processing pipeline to pivot to some parts of the company's internal systems. Hugging Face says no customer data was exposed but the attacker stole internal datasets and some cloud credentials. Hugging Face says it tried to use a frontier AI model to analyze the hack but was blocked by its guardrails, which couldn't differentiate between an IR event and offensive operations. [ Hugging Face ]

HuggingFace got hacked by an AI. What stuck out to me was the guardrail asymmetry. The attacker had no constraints, but HF's response ran afoul of the abuse guardrails, forcing them into an unplanned switch to local models. Another aspect for your IR plans. huggingface.co/blog/securit... [image or embed]

Coca-Cola hit by ransomware: Coca-Cola has suspended production at its Fairlife dairy subsidiary after a ransomware attack. In an SEC filing, Coca-Cola said hackers accessed Fairlife production-related systems this week. Production has been halted at Fairlife US factories. The company's Canadian production lines were unaffected. No ransomware group has taken credit for the incident, yet. [ SEC // TechCrunch ]

Qantas breach has a cause: The hack of Australian airline company Qantas last year was traced back to a social engineering attack. Hackers called an overseas contractor posing as the Qantas IT team to access their systems, connect to the Qantas CRM platform, and exfiltrate the data of 5.7 million customers. Australia's Information Commissioner says Qantas took all the steps to protect customer data on its side and will not be opening further probes into the hack. [ OAIC ]

Suno hack: A threat actor hacked AI music generator platform Suno and dumped internal files and documents online. The files allegedly show that Suno scraped millions of songs and lyrics from YouTube Music, Deezer, Genius, and other music platforms. The leaked files include source code and detailed scraping instructions targeting the platforms. Several music industry groups have sued Suno over the past year for training its AI song generator tool on copyrighted material. Suno was allegedly hacked following a compromise with the Shai-Hulud npm worm. [ 404 Media // The Verge ]

WINDTRE fined for breaches: Italy's privacy watchdog has fined telecommunications provider WINDTRE €1.7 million for "serious security deficiencies" that led to two security breaches last year. [ GPDP ]

KNPP leak: Threat intel analyst Rakesh Krishnan looks at a leak of sensitive files from India's KNPP nuclear power plant after one of its contractors got hit by the World Leaks extortion group. [ The Raven File ]

Ostium crypto-heist: The Ostium DeFi platform was hacked for $18 million last week after hackers exploited its own price-reporting infrastructure. [ CoinDesk ]

Estée Lauder discloses Oracle EBS breach: Cosmetics giant Estée Lauder has confirmed that hackers stole customer data from its Oracle E-Business Suite platform last year. The company disclosed the breach to US state officials almost a year after it took place. This is Estée's second breach after another one in 2023. The Clop hacking group is behind the hacking spree that targeted Oracle EBS servers. [ California OAG ]

Ernst & Young also discloses breach: Accounting and risk management giant Ernst & Young also disclosed a breach, but the disclosure has been so sanitized of any info that I can't tell what's this about. [ California OAG ]

DigiCert breach linked to CylindricalCanine: Security firm Expel has linked the hack of certificate authority DigiCert to CylindricalCanine, a sub-group of GoldenEyeDog, a financially motivated group operating out of China. [ Expel ]

Ofcom opens TikTok inquiry: The UK's communications watchdog has opened a formal investigation into TikTok for failing to protect children from harmful content on the platform, as per the UK's Online Safety Act. [ Ofcom ]

Moonshot releases Kimi K3: Chinese AI startup Moonshot has unveiled a new AI model named Kimi K3, which the company claims can rival the ones from top American firms like Anthropic and OpenAI. [ Kimi // Business Insider ]

Rust in Chromium: Microsoft is working on adding a Rust-based PNG image decoder in the Chromium browser project, a more secure component for processing PNG images for Chrome, Edge, Opera, and other similar browsers. [ Microsoft ]

EU password manager has ties to Russia: An investigation has revealed that Spain-based password manager Passwork shares its codebase and a "near-identical user manual" with a similarly-named password manager advertised in Russia. The Spanish version has allegedly been receiving software updates from an UAE firm managed by one of Passwork's Russian co-founders. The Spanish Passwork's customer list includes European government agencies and universities, which raises concerns of espionage. [ OCCRP ]

India fines HP over cartel practices: The Indian government fined HP $14.4 million over cartel practices after the company colluded with resellers to fix prices for ink cartridges, toner, and other printing supplies in government contract bids. [ ArsTechnica ]

SanFran CAO cracks down on nudify apps: The San Francisco City Attorney's Office has sent cease-and-desist letters to Apple and Google and ordered the tech giants to remove AI nudify apps from their stores and stop indirectly profiting from CSAM. [ WIRED ]

Morocco confirmed as NSO customer: A whistleblower and former member of Morocco’s domestic intelligence service has confirmed their government's access to the NSO Pegasus spyware, contrary to the government's past public denials. The tool was heavily used to spy on dissidents, journalists, and even politicians abroad. [ OCCRP // Forbidden Stories ]

UK scraps digital ID scheme: The UK government will scrap a proposed digital ID scheme once its new prime minister Andy Burnham takes office on Monday. The scheme was announced last September and was supposed to enter into effect next year. It involved issuing a digital ID for UK citizens and legal residents in the form of a mobile app. The ID was meant to serve as proof for the Right to Work in the UK. [ Reuters ]

US govt fails to rotate cyber personnel: The US government failed to follow through with one of its own programs to rotate cybersecurity employees between federal agencies. Only eight employees participated in the program since 2022. The program was meant to teach employees new skills before returning to their native agencies. [ GAO // Cyberscoop ]

White House announces Gold Eagle program: The Trump administration has launched a new program to help coordinate the disclosure and patching of vulnerabilities in open-source projects and critical infrastructure. The new Gold Eagle program was designed to receive bug reports at scale, usually found using AI tools and frontier AI models. CISA, the Treasury Department, and the Pentagon are involved in the program. [ White House ]

France bans Polymarket: The French government has ordered internet service providers to block access to prediction market betting platform Polymarket. The French regulatory authority formally banned the platform in 2024 and threatened fines of up to €200,000 for French citizens placing bets on the platform. The agency moved into active enforcement after data showed Polymarket's userbase grew in France despite the ban. Spain also banned Polymarket in May. [ Engadget ]

In this Risky Business sponsor interview , Casey Ellis chats with Haroon Meer from Thinkst about building companies customers don’t hate. Haroon explains why Thinkst still offers Canary tokens for free and why it has avoided annual price hikes on its paid products. They talk about Eric Ries’s “Incorruptible”, Rob Lee’s 100-year-company approach at Dragos, and why keeping customers happy is a better business strategy than chasing easy sugar highs.

Graykey maker sues employee for leaking exploit: Graykey-maker Magnet Forensics has sued a former employee for allegedly leaking details about a proprietary iPhone exploit. Magnet claims Mario Del Gaudio shared details of the exploit with his new employer and rival company Paradigm Shift. The exploit was tracked internally at Magnet as MSG but was disclosed publicly by Paradigm Shift in a blog post as usbliter8. The exploit allows attackers to run malicious code inside the SecureROM of Apple devices using A12 and A13 chips. It is a hardware bug and unpatchable. [ Bloomberg // CourtListener // usbliter8 blog post ]

TfL hackers get five years: A UK judge has sentenced two members of the Scattered Spider hacking group to 5.5 years in prison each. Thalha Jubair and Owen Flowers pleaded guilty last month to hacking the London public transport authority in August of 2024. The hack caused months of disruptions at Transport for London and caused damages of £39 million. Jubair is also charged in the US with hacking and extorting 47 US companies and allegedly seeking ransoms of at least $115 million. [ NCA ]

REvil hacker arrested in Armenia: Armenian authorities have arrested a suspected member of the REvil ransomware group. Alexander Ermakov was arrested at the