Romanian Waters (Administrația Națională Apele Române), the country's water management authority, was hit by a ransomware attack over the weekend. Officials with the National Cyber Security Directorate (DNSC) said Sunday that the incident impacted approximately 1,000 computer systems at the national water authority and 10 of its 11 regional offices. While the breach affected servers running geographic information systems, databases, email, and web services, as well as Windows workstations and domain name servers, operations and operational technology (OT) systems controlling water infrastructure are unaffected. Investigators from multiple Romanian security agencies, including the Romanian Intelligence Service's National Cyberint Center, who are now investigating the incident and working to contain its impact, have found that the attackers used the built-in Windows BitLocker security feature to lock files on compromised systems, then left a ransom note demanding that they be contacted within 7 days. "The National Administration 'Romanian Waters' specifies that the coordination of operations related to hydrotechnical assets is conducted dispatch centres by using voice communication channels. Hydrotechnical facilities are safe and they are locally operated by on-site personnel coordinated via the dispatch centres," the agency said. The Romanian cybersecurity agency stated that while the country's national cybersecurity system for critical IT infrastructure did not protect the w...
Romanian water authority hit by ransomware attack over weekend
BleepingComputer
·Sergiu Gatlan
·Published Dec 22, 2025
·Updated
Affected Software
1 affected component
Microsoft Windows<=10, <=Server 2019
Frequently Asked Questions
1
What happened to the Romanian water authority?
The Romanian water authority was hit by a ransomware attack over the weekend.
2
What agencies are involved in responding to the ransomware incident?
The National Cyber Security Directorate (DNSC) is involved in responding to the ransomware attack.
3
What security implications are associated with the ransomware attack?
The ransomware attack could compromise critical water management services and expose sensitive data.
4
Which software products were affected by the ransomware attack?
The ransomware attack affected systems running Microsoft Windows, including versions up to Windows 10 and Server 2019.
5
What precautionary measures should organizations take to prevent similar attacks?
Organizations should implement regular data backups, robust security measures, and employee training to prevent ransomware attacks.