Romania’s Cybersecurity Risk Enters a New Phase: Energy, Healthcare and Public Administration Among the Most Exposed Sectors

Romania is gradually strengthening its ability to respond to cyber threats, but significant risks remain, particularly in sectors responsible for essential infrastructure and services.

According to assessments presented by Romania’s National Directorate for Cyber Security (DNSC), the overall national cybersecurity risk level is currently considered medium. However, certain sectors face higher levels of exposure, with energy, public administration and healthcare among the areas of greatest concern.

The assessment was presented by Andi Mihai, advisor to the Director General of DNSC, during the ZF & Orange Business conference focused on operational resilience.

Critical infrastructure remains a prime target

The three sectors identified are not at the center of attention by chance. Energy, healthcare and public administration play a direct role in the functioning of society, meaning that disruptions to their digital infrastructure can have consequences far beyond the IT environment.

A cyberattack against an organization operating in one of these sectors can result not only in financial losses or unavailable systems, but also in the disruption of services relied upon by citizens, businesses and other institutions.

DNSC reached its assessment through sector-specific workshops and by analyzing self-assessments submitted by organizations covered by the NIS2 cybersecurity framework.

At national level, the overall risk is predominantly medium, but the three sectors mentioned above show a tendency toward higher levels of exposure.

256 ransomware incidents handled in 2025

The scale of the threat is also reflected in the number of ransomware incidents handled by DNSC.

In 2025, the authority dealt with 256 ransomware incidents. According to the figures presented, these incidents affected 22 public institutions, 119 legal entities and 115 individuals.

The number represents an increase of more than 153% compared with the previous year, highlighting the continued significance of ransomware attacks for organizations and users in Romania.

At the same time, the increase in reported incidents may also reflect improved cooperation between affected organizations and the authorities responsible for cybersecurity response.

NIS2 is changing how companies approach cybersecurity

One of the key changes introduced by the new cybersecurity framework is the shift from formal compliance toward a broader risk-management approach.

In practice, cybersecurity can no longer be treated simply as a checklist of technical requirements that an organization needs to meet.

Security needs to become part of the way companies manage risk, protect their infrastructure and assess their suppliers and business partners.

This is particularly important because vulnerabilities within a supply chain can, in certain circumstances, provide attackers with an entry point into an organization’s systems.

Boards and senior management are increasingly part of the cybersecurity equation

Another important development is the growing recognition that cybersecurity is a management issue, not just a technical one.

Decisions concerning security investments, operational continuity, incident response and supplier risk need to be addressed at the leadership level.

Against this backdrop, DNSC is also seeking to engage with the leadership structures of organizations through dedicated sessions and workshops.

There is no ranking of the “best protected” sectors

An interesting aspect of the DNSC assessment is that the authority does not provide a ranking of sectors based on their level of protection.

Such a ranking would require common, measurable criteria that could be consistently applied across all sectors.

Instead, the available data makes it possible to identify areas where vulnerabilities appear to be more significant and where efforts to strengthen cyber resilience should continue.

From response to prevention

The message coming from DNSC is that cybersecurity cannot be the responsibility of a single institution or department.

Government authorities, businesses, public institutions and individual users all have a role to play in reducing cyber risk.

When an attack occurs, the ability to respond quickly is critical. However, prevention, preparedness and well-defined business continuity plans can determine whether an incident remains a temporary disruption or develops into a major operational crisis.

For Romania, the next stage may therefore be a broader change in perspective: cybersecurity needs to become part of business strategy and enterprise risk management, rather than being viewed solely as an IT responsibility.

And in sectors such as energy, healthcare and public administration, the stakes go beyond protecting computer systems. They involve maintaining essential services on which society depends.