Romania's National Cyber Security Directorate (DNSC) has published its 2025 activity report, approved by the Supreme Council of National Defence through CSAT Decision no. 117 of 7 August 2026. Unlike global threat reports, this one describes what actually happened in Romania, to organisations that look like yours. It is worth reading as a priority list rather than as a statistic.
The headline figures:
- 25,307,028 relevant cyber security events recorded by DNSC sensors during 2025.
- 7,251,708 attempts associated with phishing campaigns, against 941,076 in 2024 — an almost eightfold increase.
- Approximately 5.88 million brute-force attempts.
- Ransomware incidents: up 153% on 2024, with 256 major incidents handled, affecting 22 public institutions, 119 legal entities and 115 individuals.
- Phishing incidents: 4,975, up 70.6%.
- Account compromise: 1,125, against 248 in 2024 — a 353% increase.
- Brute-force incidents: 47, against 172 in 2024 — down 72.7%.
The most affected sectors were banking, postal and courier services, financial market infrastructure, public institutions and strategic companies, including the defence industry.
The number that matters is not the biggest one
Press coverage stopped at "25 million events". That is the least useful figure in the report, because a sensor detection is not a victim. The operational insight is in the comparison between attempts and actual incidents.
Nearly 5.88 million brute-force attempts produced 47 incidents. In other words, the technical controls that defeat password guessing — account lockout, rate limiting, MFA, reduced exposure of RDP and management interfaces — are working. Incident counts fell 72.7% in a year when attempt volume remained enormous. That is a genuine win for the technical hygiene work of recent years.
Over the same period, account compromise rose 353% and phishing rose 70.6%.
The conclusion is direct: attackers stopped breaking passwords and started asking for them. When the front door is locked, the target becomes the person holding the key. Finding both figures in the same report, moving in opposite directions, is not a coincidence — it is a reallocation of attacker effort, visible in one country's data.
What this means for a 2026 security programme
If next year's security budget still tilts mostly toward perimeter controls, the DNSC report is telling you that you are funding the fight you have already won while losing ground on the one that replaced it.
1. Phishing-resistant MFA, not just MFA. The 353% rise in account compromise shows that second factors based on SMS codes, authenticator codes or push notifications are no longer sufficient for privileged accounts. All of them can be relayed in real time through an adversary-in-the-middle portal. Passkeys and FIDO2 security keys cannot be passed from the user to the attacker, because they are cryptographically bound to the real domain. Prioritise them on administrative accounts, financial systems access and executive management.
2. An awareness programme measured on behaviour, not attendance. Article 20 of NIS 2 makes management personally accountable and requires training, including for management themselves. A programme reporting "92% of staff completed the course" does not answer the relevant question. The relevant question is how many employees reported the suspicious message, how quickly, and whether the response team acted on the report. Reporting rate is a more useful indicator than click rate, because it measures the defence rather than only the failure.
3. Phishing simulations that resemble what actually happens. A volume of 7.25 million recorded attempts indicates automated campaigns at industrial scale. A phishing simulation built on a generic "invoice attached" scenario no longer reflects the threat. The scenarios that matter now are the ones that produced the incidents in the report: messages impersonating banks and courier companies, fake Microsoft 365 sign-in portals, device code phishing and OAuth consent requests. Banking and courier brands are the most impersonated in Romania — if your simulation does not use them, you are testing something else.
4. Ransomware: test recovery, not backup. The 256 major ransomware incidents did not happen through spectacular cryptography. They happened through access obtained with valid credentials or through exposed, unpatched services. The difference between an expensive incident and a catastrophic one shows up at recovery. A backup that exists is not the same as a backup isolated from the network, protected against deletion by any account the attacker can reach, and actually restored in a test, with the time measured and compared against the recovery objective you have committed to.
5. An external attack surface inventory. Public institutions and strategic companies appear consistently in the victim list. In practice the entry point is usually a service nobody was claiming ownership of: an old VPN, an exposed management interface, a test environment left public, a server inherited from a supplier. An external penetration test starts exactly there — from the attacker's view, not from the network diagram.
What a penetration test should actually answer
A threat report tells you what happened to other people. A penetration test tells you whether it can happen to you. Applied to the patterns in the DNSC report, testing should answer specific questions:
- Which of your services are reachable from the internet, and which of them are missing from the official inventory?
- Does one ordinary user account compromised through phishing allow escalation to domain administrator, and in how many steps?
- Does your MFA implementation survive an adversary-in-the-middle attack, or only password guessing?
- Does network segmentation genuinely limit lateral movement, or is it documented but not enforced?
- Can backup infrastructure be reached or deleted from the segment an attacker lands in after compromising a workstation?
For organisations in scope of NIS 2, these answers are also evidence. A security audit and the NIS 2 and DORA checklist help map your current posture against regulatory obligations, while human risk management addresses precisely the area where the DNSC report shows the sharpest deterioration.
The question to answer this week
Not "have we been attacked?" — with 25 million events recorded nationally, the answer is yes, whatever the size of the organisation.
The useful question is different: if an employee enters their credentials and MFA code into a fake portal impersonating their bank or Microsoft 365 today, how long before anyone notices, and what can the attacker do with that account in the meantime? If you cannot answer with evidence — an exercise you ran, a time you measured, a test report — then the DNSC report is already describing your next incident as well.
This article is general information and does not constitute legal or regulatory advice. NIS 2 obligations depend on your sector, organisation size and the national transposition legislation (Government Emergency Ordinance no. 155/2024 in Romania).
Sources: DNSC 2025 activity report — JURIDICE.ro; AGERPRES, 14 August 2026; Economedia; Mediafax; DNSC. Figures are as published in the DNSC public report and its press coverage.