Romanian responders describe the outcome

Romania’s intelligence service said on November 11 that its national cyber intelligence center detected an attack on a government institution in December 2025, stopped it and remediated the affected email service. Investigators identified no exfiltration of sensitive data, the service said. Its statement supplies an important piece of the incident record following ESET’s publication of evidence about the collection of government correspondence.

Two views of the same investigation

ESET reported finding software on a Romanian government mail server configured to collect messages involving NATO and European Union addresses. That finding speaks to the operator’s interests. The Romanian statement addresses a different question: what national responders established about the movement of sensitive material. A collection rule, a message meeting the rule and a verified transfer out of the organization are three separate pieces of evidence. Neither account names the affected agency.

Partner notification

The intelligence service said it informed the appropriate Romanian authorities and cooperated with European intelligence partners and counterparts at the EU and NATO. Those contacts describe the response to the incident; they establish no compromise of partner systems. Romania also says it continues to investigate other activity connected to Russian cyber campaigns. The government statement does not identify specific records reviewed or disclose the technical basis for ruling sensitive transfers in or out.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Government & defense
Suggest a correction →