Cyberattack on Romania’s Central Depository: What Investor Data Was Exposed and What Does It Mean for the Bucharest Stock Exchange?

A cyberattack targeting Romania’s Central Depository, an institution essential to the functioning of the country’s capital market, has once again highlighted the security risks associated with the digitalization of financial services. According to information released by the institution and reported by Romanian media, the attack allowed unauthorized access to personal data belonging to users of its “Online Services for Investors” application.

Although the incident raises important questions about data protection, the institutions involved have drawn a clear distinction between the exposure of personal information and the systems responsible for maintaining securities ownership records and settling stock market transactions.

What Happened at the Central Depository?

On October 16, 2026, Romania’s Central Depository confirmed that it had been targeted by a cyberattack affecting its “Online Services for Investors” application. The platform is used by individuals in Romania to create accounts and access certain services provided by the institution.

According to the institution’s statement, the incident was identified on the day it occurred, prompting immediate investigation and remediation measures. The relevant authorities were also notified, and monitoring of the institution’s IT systems was intensified.

According to information published by HotNews, the personal information that may have been viewed includes users’ full names, addresses, personal identification numbers (CNPs), identity card series and numbers, email addresses, telephone numbers, and bank account IBANs.

The institution stated that the data had not been modified or altered. Furthermore, the available information does not indicate that securities ownership records or data relating to settled transactions were compromised.

Was the Bucharest Stock Exchange Affected?

One of the most important aspects of this incident is the distinction between the affected application and the critical infrastructure supporting Romania’s capital market.

The Central Depository plays an essential role in maintaining records of securities ownership, managing shareholder registers, and settling transactions. In practical terms, it helps ensure the official recording of share ownership and the transfer of securities following stock market transactions.

The Bucharest Stock Exchange (BVB), on the other hand, operates the market where securities are traded, while the Central Depository performs separate functions related to securities records and settlement.

In a public statement, the Central Depository said the incident had not affected its critical registry and settlement services. The institution also stated that securities ownership records and information concerning settled transactions had not been accessed, modified, or altered.

The Bucharest Stock Exchange likewise announced that its own IT systems were operating normally and that trading sessions were proceeding according to the usual schedule.

These clarifications are important: a cybersecurity incident involving the exposure of personal data does not automatically mean that investors’ shareholdings have been affected or that stock market transactions have been compromised.

Sources: Central Depository statement, published by AGERPRES and Digi Economic – statements concerning BVB operations.

Why Is the Exposed Personal Data Important?

Even though information concerning shareholdings has not been reported as compromised, the exposure of personal data can create risks that should not be ignored.

The combination of a person’s name, national identification number, identity document details, telephone number, email address, and IBAN can potentially be exploited for fraud or identity theft.

Phishing and social engineering attacks represent a particular risk. In these scenarios, criminals may use genuine information about an individual to create convincing messages while impersonating a bank, brokerage firm, or public institution.

For example, a user might receive an email or text message referring to their supposed investment activity and asking them to click a link, confirm their personal details, or provide additional information.

The fact that a message contains accurate personal information does not prove that it is legitimate.

It is important to emphasize that these scenarios represent potential risks, not evidence that the data exposed in this incident has already been used in other fraudulent activities.

What Should Investors and Application Users Do?

In light of the incident, users can take several precautionary measures to reduce the risk of potential fraud.

1. Be cautious with unexpected messages. Emails, text messages, and phone calls requesting personal information, banking details, or login credentials should be carefully verified, even when the sender appears legitimate.

2. Avoid clicking on suspicious links. To check their accounts or access available services, users should rely on the institution’s official contact details and verified communication channels.

3. Never share passwords or authentication codes. Such information should not be disclosed to people who contact users unexpectedly.

4. Monitor bank accounts. Regularly reviewing transactions and promptly reporting unauthorized activity to the bank can help limit potential losses.

5. Contact the institution for clarification. Individuals who have used the application can consult the Central Depository’s official announcements to find out what measures are recommended in their particular circumstances.

According to the information published in its official statement, the Central Depository indicated that its services remained available through its usual communication channels, including postal correspondence and in-person visits to its offices.

What Does This Incident Tell Us About Cybersecurity?

The attack on the Central Depository highlights an important challenge for financial institutions: protecting critical infrastructure must go hand in hand with securing every application that processes customer data.

Even when the main trading and settlement systems remain operational, a supporting application may contain valuable personal information. Consequently, cybersecurity should not be assessed solely in terms of service continuity, but also in terms of data confidentiality.

The incident also underscores the importance of rapidly detecting attacks, isolating affected systems, investigating their causes, and communicating transparently with potentially affected individuals.

At the same time, caution is necessary when drawing conclusions. The investigation must establish exactly how the attack occurred, the extent of the unauthorized access, and any potential consequences. The publicly available information does not justify attributing the attack to a particular group or concluding that the data has already been used for fraudulent purposes.

Conclusion

The cyberattack on Romania’s Central Depository is a warning about the importance of protecting personal data in the country’s financial sector. Although the institution stated that securities ownership records and information concerning settled transactions had not been compromised, the exposure of personal information may still create risks that require attention.

For investors, the main recommendation is to remain vigilant, verify the authenticity of communications they receive, and avoid disclosing sensitive information.

For financial institutions, the incident reinforces the need for robust security measures, continuous monitoring, and clear communication whenever an incident may affect customer data.

In an increasingly digital financial system, trust depends not only on the smooth functioning of the market, but also on institutions’ ability to protect the information of the people who use it.

Sources and References

1. HotNews.ro – “Cyberattack on the Central Depository, the entity responsible for stock market transactions: ‘Users’ personal data was viewed’,” October 16, 2026.
   https://hotnews.ro/atac-cibernetic-la-bursa-de-valori-bucuresti-tinta-institutia-prin-care-se-fac-toate-tranzactiile-2377666
2. Central Depository / AGERPRES – “Press Release – Central Depository,” October 16, 2026.
   https://agerpres.ro/comunicate/2026/10/16/comunicat-de-presa—depozitarul-central–1603686
3. Digi Economic – “What the Bucharest Stock Exchange Says Following the Cyberattack on the Central Depository: Clarifications Regarding Stock Market Transactions,” October 16, 2026.
   https://www.digi24.ro/digieconomic/financiar/ce-spune-bursa-de-valori-bucuresti-dupa-atacul-cibernetic-de-la-depozitarul-central-precizari-privind-tranzactiile-bursiere-123599
4. Radio Romania Actualități – “Central Depository Announces It Was Targeted by a Cyberattack,” October 16, 2026.
   https://www.romania-actualitati.ro/stiri/romania/depozitarul-central-anunta-ca-a-fost-tinta-unui-atac-cibernetic-id235951.html