The Central Depository, the entity through which all transactions on the Bucharest Stock Exchange (BVB) are carried out and which manages all data on transactions and contracts, was the target of a cyberattack on Friday, October 16.
The attack impacted the Online Services for Investors application, according to the official press release. This application, which is auxiliary to the Central Depository system, is used to create user accounts for investors (Romanian individuals) interested in accessing the online services provided by the Central Depository.
The incident was identified on the day it occurred, and the necessary investigation and remediation measures were taken immediately. System monitoring has been intensified, and operations are proceeding under normal conditions, according to the same source.
“The incident did not affect the Central Depository’s critical services and functions related to settlement and registry operations, which are being carried out under normal conditions. In particular, financial instrument holdings and information regarding settled transactions were not accessed, modified, and/or altered,” the Central Depository added.
At this time, no user data has been affected, and no information has been lost, because the IT system benefits from a highly efficient backup system, according to Economica.
“At this time, the Application is temporarily unavailable. Based on the information available to us so far, personal data belonging to our users were viewed as a result of the cyberattack, namely data used in the user registration/account creation process: first and last name, address, personal numerical identification code, identity card series and number, email address, telephone number, and IBAN code. These data have not been modified and/or altered,” the Central Depository stated.
The institution also said that it has already hired a team of specialists and notified the National Directorate for Cyber Security (DNSC) about the cyberattack.
The Central Depository's message also includes the steps investors and other people using the application should follow.
“Although your password for accessing the Application was not accessed during the cyberattack, if you use the same passwords for multiple online services, we recommend changing them and using separate passwords. Also, enable two-factor authentication, if available. We apologize for the concern and any inconvenience caused by this incident.”