Depozitarul Central Cyberattack Exposes Investor Data
A Breach That Spared the Market
A cyberattack on stock market infrastructure does not always halt trading. Even so, it can still give criminals access to sensitive investor details. That is what the Romanian Central Depository, known as Depozitarul Central, faced this month.
The depository reported a compromise of personal data from users of its online platform. Meanwhile, its key securities operations kept running as normal.
What Happened on October 16
The incident took place on October 16, 2026. It hit the Online Services for Investors application, where users create accounts and reach the depository’s services.
After it detected the attack, the organization took the application offline and opened an investigation. Early findings suggest the intruders viewed personal data but did not change it.
Data That May Have Been Exposed
The potentially exposed data includes:
- Full names and addresses.
- Personal identification numbers.
- ID card series and numbers.
- Email addresses and phone numbers.
- IBAN bank account numbers.
The depository stated that attackers did not obtain the passwords for the application. The published details also show no sign of altered or destroyed information.
Core Systems Stayed Safe
The breach did not touch the depository’s critical systems. Those systems record securities holdings and settle trades made on the Bucharest Stock Exchange.
According to the organization, no one could alter data on ownership of financial instruments or completed transactions. The exchange also confirmed that its systems work normally and that trading continues on schedule.
Response and Alternatives
The depository brought in specialists for the investigation. It also notified Romania’s National Cyber Security Directorate and says it is working with the competent authorities.
The online application remains unavailable for now. However, securities holders can still use regular channels, by mail or in person at the organization’s office.
Advice for Affected Users
Attackers can use the exposed details for more convincing fraud and social engineering. Users should therefore take these steps:
- Use a unique password for each service.
- Turn on two-factor authentication where it exists.
- Scrutinize suspicious emails, SMS messages, and phone calls.
Above all, never hand over confidential information in response to unverified requests. This holds even when the sender claims to be a depository employee.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
