A Country's Property Records Vanished. Now What?

What proves your house is yours? Not the keys. Not the mortgage. A row in a government database. Reports out of Romania that the national land registry had data destroyed turned a subject nobody thinks about — public sector backup hygiene — into something a lot more urgent.

Let me be upfront about what this piece is and isn’t. The details of this specific incident are still thin, and I’d rather not stack up unverified numbers to make it sound authoritative. So instead of litigating the forensics, I want to talk about why this class of failure keeps happening, and what actually determines whether a country recovers from it.

A Land Registry Is the Worst Possible Thing to Lose

There’s a category difference between a data breach and a data destruction event that gets flattened in headlines. A breach means information was copied. The original is intact; the damage shows up as fraud risk and privacy harm. Destruction means the original is gone. No copy, no information — anywhere.

Land registries sit at the extreme end of that spectrum, for three reasons.

They’re irreplaceable. Your bank transactions exist twice — your bank has them, so does the counterparty’s. But the question “who owns this parcel” has exactly one authoritative answer, and it lives in one government ledger. The absence of a competing record is the entire point of a registry. It’s also a textbook single point of failure.

They’re cumulative across centuries. Title records are sediment: inheritances, subdivisions, sales, easements, layered over generations. Losing last month’s entries is bad. Losing the 1920s is unreconstructable, because the people and paper that could corroborate those transfers are dead and pulped.

They’re load-bearing for the economy. Mortgages, probate, property tax assessment, zoning, infrastructure planning — all of it dereferences the registry. Shake that record and you shake the banking system attached to it. In the US, this is roughly what the MERS mess exposed during the 2008 foreclosure crisis: when chain-of-title got murky, courts couldn’t tell who had standing to foreclose, and the whole apparatus jammed. That was a paperwork problem. Deletion is worse.

“We Have Backups” and “We Can Restore” Are Different Sentences

Watch the pattern in these incidents. The agency announces within 24 hours that backups exist. Then days pass with no restoration. Here’s why that gap keeps showing up.

The backups were online. When an attacker gets domain admin, they don’t just wipe production. If backup storage sits on the same network under the same identity provider, it dies in the same operation. This has been standard ransomware tradecraft for years — the crews go after Veeam repositories and snapshot infrastructure first, then encrypt. Killing the recovery path is what makes the ransom credible.

Nobody ever tested a restore. A nightly backup job that logs success for 2,000 consecutive nights tells you the job ran. It does not tell you the resulting artifact is a functioning database. Unreadable tapes, schema drift, missing encryption keys, a restore that takes eleven weeks at the available I/O — the industry is littered with organizations that discovered this at the worst possible moment. GitLab’s 2017 incident is the canonical public example: five backup mechanisms, none of them actually working, discovered during a live outage.

Retention windows are too short. If an intruder has been quietly corrupting records for six months and you keep 30 days of backups, you have thirty days of poisoned data. The backups exist. They’re just all bad. Dwell time in public sector networks routinely runs past a year.

3-2-1 Was Never Enough. It’s 3-2-1-1-0 Now

The old rule: three copies, two media types, one offsite. It predates the cloud and it’s still the right skeleton. But it assumes the failure mode is a fire or a dead disk, not an adversary with your credentials.

Hence 3-2-1-1-0. The extra 1 is one copy that’s offline or immutable — write-once storage with a retention lock that a domain admin cannot override, that you cannot override, that not even a valid credential can override. The 0 is zero errors in recovery verification, meaning you periodically perform an actual restore and confirm the system comes up.

Those last two digits are the entire modern security argument. You have to design assuming full administrative compromise. “Tighten access control” is not a backup strategy — it’s a delay tactic that eventually fails. Assume the keys get stolen and make sure there’s a copy the keys can’t reach.

Why Government Systems Fail Harder

When a private company loses its data, market pressure at least exists. Customers churn, the stock drops, a CISO gets fired, and the incident gets written up as a case study. Public systems have none of those feedback loops, and two structural problems on top.

The first is budgeting. Backup infrastructure is spend that produces nothing visible when everything works. Ask any legislator whether they’d rather cut the ribbon on a new citizen services portal or fund an offline tape rotation and quarterly restore drills. That’s not a hypothetical — it’s why DR line items are the first thing cut in every public IT budget cycle on both sides of the Atlantic.

The second is legacy. National registries are typically decades of accreted code, sometimes with a COBOL layer at the bottom. Original architects retired. Documentation is folklore. Maintenance is locked to one or two vendors with no incentive to volunteer that the recovery plan is fiction. “Let’s validate the restore procedure” needs an owner, and in these systems there often isn’t one.

The Question That Actually Matters

Who did it is the least interesting part of this story. What matters is whether the data comes back, and if it doesn’t, what the state uses to re-establish ownership.

The answer will be redundancy nobody planned: notary archives, tax assessment rolls, municipal records, mortgage lenders’ own files, the paper deed in someone’s filing cabinet. How much of that distributed shadow record survives determines the real blast radius. There’s a genuine irony here — the less digitized a jurisdiction is, the softer its landing. Full digital transformation without immutable backups doesn’t just modernize your records. It removes the redundancy that was protecting you by accident.

Which points the question back at everyone reading this. Your national ID database, your health records system, your property registry — is there an offline copy? Has anyone performed a full restore in the last twelve months, end to end, with a stopwatch running? Not “do we have backups.” Have we restored from them recently.

The cruel thing about backup verification is that doing it today produces nothing. No incident averted, no metric improved, nothing to report. That’s precisely why it’s the easiest work in the world to postpone, and why the postponement is invisible right up until it’s catastrophic. So: when did your organization last run a real restore?