The DNSC's activity report for 2025, published in August 2026, contains one figure that should land on the desk of every company director: the number of ransomware attacks in Romania grew by more than 153% compared with the previous year. The DNSC handled 256 major incidents of this kind and supported 119 companies, 22 public institutions and 115 private individuals. Among the public cases: an attack that disrupted the National Administration Romanian Waters and its regional branches for roughly a week.
And those are only the cases the DNSC was called into. The companies that paid, or quietly rebuilt everything, never make it into the statistics.
We are not writing this article to scare anyone. We are writing it because protection against ransomware is not a technology you buy, but a set of decisions you take beforehand. Almost all of them are cheap. All of them are boring. And every one of them decides whether, on the day it happens, the company is back in two days or loses its data.
How an attack really starts
The movie image, with the hacker breaking through a firewall, is the least common one. The DNSC report shows very concretely how simply an attack can start: an ordinary-looking email, a reused password, a hijacked email account or an unpatched program. Compromised accounts more than quadrupled in 2025 compared with the year before, and phishing attacks rose by more than 70%.
The trend is confirmed globally too: stolen accounts and credentials have overtaken the exploitation of vulnerabilities as the main way ransomware attacks are launched. The attacker no longer breaks the door down. He walks in with the key.
The business model behind it is industrialised: specialised groups rent their attack tooling to others, for a fee, the so-called “ransomware-as-a-service”. That means you do not have to be an interesting target to get hit. Being an easy target is enough. And the DNSC even flags a group of Romanian origin, active mostly in the finance and accounting space.
One detail changes the maths: today's attacks do not just encrypt. Before encryption, the data is copied. Even if you have a backup and refuse to pay, the attacker threatens to publish your contracts, your employees' data, your clients' data. The backup saves you operationally. It does not save you from the conversation with your clients and with the data protection authority.
Five decisions that make the difference
1. Centrally managed identities, with multi-factor authentication everywhere
If the attack starts with a password, the first line of defence is to make a password not enough. The DNSC explicitly lists password reuse and the absence of multi-factor authentication among the factors that favour attacks. That means: MFA enforced on email, on the business systems, on remote access, on administrator accounts. Not “recommended”, not “for whoever wants it”. Enforced from the console, with zero exceptions.
One step further, for the accounts that matter: phishing-resistant authentication (hardware keys or passkeys), because classic MFA by SMS code can be tricked by a fake login page.
And administrator accounts are separate from everyday accounts. The person reading email with administrator rights over the whole domain is the shortest path from one wrong click to a paralysed company.
2. Isolated, versioned backups, tested by restoring them
Modern ransomware looks for the backups before it encrypts. A backup on a permanently connected disk, on a network share reachable with the same credentials, or in the same cloud tenant without separate protection gets encrypted along with everything else.
What works: at least one copy isolated from the production network, with versions kept over time and impossible to delete for a defined period (immutability), using credentials different from the production ones. And, essentially, with a restore actually performed, periodically, against the clock. A backup you have never restored is a hypothesis. We will come back to this in a separate article, because it deserves one.
3. Timely updates, on everything that is exposed
“Unpatched software” is on the DNSC's list of causes. Every system reachable from the internet (VPN, remote access, email server, web applications) has to be updated within days, not months, when a vulnerability appears. The same goes for workstations. This is done in a managed way, from a console, with a compliance report, not by “asking colleagues to please restart”.
4. Endpoint and server protection that detects behaviour, not just signatures
Classic antivirus recognises known files. Today's ransomware is generated in new variants for every campaign. What matters is a solution that watches behaviour (mass encryption, deletion of backups, privilege escalation) and isolates the machine automatically, within seconds, without waiting for someone to read an alert the next morning.
Add to that the principle of least privilege: users are not local administrators, file access is role-based, and a compromised account in sales cannot reach accounting.
5. A plan that someone has actually read
What do you do in the first hour? Who disconnects what? Who calls the IT provider, who informs management, who notifies the DNSC and, if personal data is involved, the data protection authority? Which clients need to be told, and by whom? Which backup do you restore from, and how long does it take?
If the answers to these questions are given for the first time on the day of the attack, they are given badly. The plan does not need 40 pages. It needs one page, people's names, phone numbers, and to have been rehearsed once, at least on paper.
The rest, which matters just as much
Training people, but concretely: not an annual course on “internet safety”, but real examples of the emails and messages your colleagues actually receive, including on WhatsApp, which the DNSC names as a campaign vector. A simple channel through which anyone can report “I clicked on something odd” without being told off; the first minutes matter more than blame.
The inventory: you cannot protect what you do not know you have. Which servers, which applications, which administrator accounts, which vendors have access to your systems.
The vendors: the accounting firm, the IT company, the software vendor with remote access. Each of them is a door into your company. Ask them what they do about points 1 to 5.
If it happens anyway
Disconnect the affected systems from the network, but do not shut them down and do not wipe them; they hold the evidence. Do not pay by reflex; paying does not guarantee recovery and marks you as a target that pays. Notify the DNSC, which has experience with the groups active in Romania and may hold decryption keys for certain families. If personal data is affected, you have 72 hours to notify the data protection authority. And restore from the backup you have tested.
What we do
The five decisions above are exactly the list of measures NIS2 asks for, and exactly what a properly built IT setup means, a subject we cover in the articles that follow. That is no coincidence. Protection against ransomware is not a product separate from the rest of IT. It is IT done properly.
For our clients, that means: centrally managed identities with enforced MFA, workstations and servers managed from a console, with updates and behavioural protection, isolated backups with periodically tested restores, role-based access rights, and a one-page written response plan with your own people in it.
If you are not sure where your company stands on the five points, a check takes a few hours and the answer is usually very clear.
Sources: DNSC Activity Report 2025 (public version, approved by CSAT Decision no. 117/2026), DNSC quarterly statistical bulletin 2026, DNSC communications (dnsc.ro).
