Romania's Central Depository hit by cyberattack, investor personal data exposed
Romania's Central Depository, which settles trades on the Bucharest Stock Exchange, says attackers viewed personal data of users of its investor app. The application is offline while specialists work on the breach.
What happened
Depozitarul Central, the Romanian institution that keeps records of shares and other financial instruments and handles transfers between sellers and buyers, was the target of a cyberattack reported on Friday, 16 October 2026. The attack aimed at the Online Services for Investors application, which lets individual Romanian investors create user accounts for the depository's online services. The institution said the incident was identified on the day it occurred and that investigation and remediation measures were started immediately. The depository is part of the Bucharest Stock Exchange group and settles the trades made on the exchange.
The application was taken offline temporarily to contain the attack, and the institution said it remained unavailable when it issued its notice. Libertatea, citing Economica.net, reported that sources inside the institution said stored data had not been altered and that backup systems were running at optimal parameters.
Personal data viewed
The institution said personal data of users was viewed during the attack, specifically the information used when investors enroll or create accounts. That covers full name, address, personal numeric code (CNP), identity card series and number, email address, telephone number and IBAN bank code. The depository said the data were not modified or altered. It also said account passwords were not accessed, though it advised users who reuse passwords across services to change them.
Libertatea reported that the depository's systems also hold historical records for millions of shareholders known as "cuponari", who received shares in the mass privatisation of the 1990s and have kept them since. The same outlet said exposed identity details raise the risk of follow-on social engineering and identity theft.
Services and response
The depository said the incident had no bearing on the critical and important services tied to settlement and the share register, which continue under normal conditions. Holders of financial instruments still have access to all services provided by the depository.
Holders of financial instruments still have access to all services provided by the Central Depository.
The institution said it had informed the competent authorities and was cooperating with them on the analysis. It notified the National Cyber Security Directorate (DNSC), the authority responsible for threats to critical infrastructure in Romania, and contracted a specialist company in offensive security and incident response. Investigators are examining the attack vector and the path the attackers followed inside the internal network, and monitoring of systems has been stepped up.
Advice to investors
The depository urged users to choose unique passwords, enable two-step authentication where available, avoid suspicious links and ignore unsolicited messages by email, SMS or phone that ask for credentials or personal data. It also warned of fraud attempts that imitate its communications.
Verify the authenticity of requests and pay close attention to any unusual communications that appear to come from us.
The institution asked users not to publish personal information on social media or share it through online questionnaires, since such details can make fraud and social engineering attempts more convincing. It apologised for the concern and inconvenience caused by the incident.