Ransomware Attack on Romanian Waters Authority – 1,000+ IT Systems Compromised
On Sat, Dec 20, 2025, Romania's National Administration "Apele Române" (Romanian Waters) experienced a significant ransomware attack. The incident compromised approximately 1,000 IT systems, impacting 10 of its 11 regional water basin administrations.
On Sat, Dec 20, 2025, Romania's National Administration "Apele Române" (Romanian Waters) experienced a significant ransomware attack. The incident compromised approximately 1,000 IT systems, impacting 10 of its 11 regional water basin administrations.
The attack affected critical infrastructure related to the country's water resources and hydrotechnical operations, though operational technologies were not compromised.
The cyberattack targeted various systems, including:
Geographical Information System (GIS) application servers Database servers Windows workstations and servers Email and web servers Domain Name Servers (DNS)
Attackers utilized BitLocker, a legitimate Windows encryption tool, to encrypt files on affected systems.
On Sat, Dec 20, 2025, Romania's National Administration "Apele Române" (Romanian Waters) experienced a significant ransomware attack.
The affected facilities include those in Oradea, Cluj, Iasi, Siret, and Buzău. The perpetrators left a ransom note demanding contact within seven days.
The National Directorate of Cyber Security (DNSC) maintains a policy against engaging with cybercriminals to avoid supporting illicit activities. Technical teams from DNSC, the National Cyberint Center (CNC), and other cybersecurity bodies are investigating the incident and working on system restoration.
Despite the IT system compromise, operational technologies controlling hydrotechnical structures remained intact, allowing critical operations to proceed normally. Dispatchers used telephone and radio communications for coordination, while personnel operated hydrotechnical structures locally. Forecasting and flood defense activities were not disrupted.
The investigation identified a lack of prior protection for Romania's water infrastructure within the national cybersecurity framework. Authorities are now taking measures to integrate this infrastructure into the national cyber protection system, which aims to safeguard both public and private critical IT infrastructures.
This incident underscores the vulnerabilities in water utility infrastructure, highlighting the need for enhanced cybersecurity measures to protect essential services. Ongoing investigations prioritize the restoration of IT services while ensuring the operational safety of Romania's water management systems.
Based on reporting by Cyber Security News.