The ransomware attack on ANP was announced on 29 July 2026. The general public felt the effects far more strongly than the cyberattack itself. The online portal for scheduling visits was temporarily shut down. The institution's website and certain VPN connections were also suspended immediately. This sudden shutdown was merely a strict precautionary measure. These services had not necessarily been compromised or destroyed by the hackers. They were shut down because nobody could guarantee their safety at that moment. The decision to switch off something that works perfectly is extremely hard. It is nevertheless absolutely essential to save the rest of the unaffected network. This article explains in simple terms the technical reasoning behind these drastic measures.
What exactly happened in the cyber incident at ANP?
The institution officially announced the compromise of several workstations and servers. The hackers used ransomware. It encrypted the data and quickly demanded a monetary ransom. The IT team immediately contacted the National Cyber Security Directorate (DNSC). All affected IT equipment was isolated very quickly. This isolation massively limited the immediate spread of the digital incident. However, the preventive measures went much further in this case. The internal applications and the visits portal were shut down completely. Some remote connections (VPN) were also blocked immediately. DNSC management pointed to the Babuk group as a mere working hypothesis. This attribution was not confirmed with absolute certainty at that time. Professional investigations are very complex and take an enormous amount of time.
Why must you shut down a system that seems completely untouched?
Many managers and entrepreneurs do not understand the decision to shut down as a precaution. They keep asking why we close perfectly healthy services. The specialists' answer is in fact extremely simple and very logical. In the first hours after an attack, you have no idea what is compromised. The ransomware that encrypts files is only the last stage of the operation. It is never the beginning of the cyberattack on a company. Until encryption, the attacker has been sitting quietly in the targeted network. They searched for user accounts with very high administrative rights. They identified the important servers and tried to reach the backups. The right question is not what they managed to encrypt. The truly vital question is where else the criminal has been. If you cannot answer firmly, you are obliged to shut everything down immediately. This is the only fully responsible option for protecting your organisation.
What is the response team's reasoning in the first hours?
The security team immediately asks itself a few absolutely critical questions. Which specific accounts did the attacker use to get into the network? Any IT system accessible with those accounts automatically becomes highly suspect. Which systems communicate directly with the areas already badly hit by the virus? In a network that is not properly segmented, the tragic answer is usually "all of them". Are VPN connections really safe at this critical moment? With stolen passwords, the VPN simply becomes an open door. Does the public portal share server infrastructure with the area already attacked? If the answer is yes, it is exposed and must be shut down urgently. The cost of shutting down is always extremely visible and disruptive for everyone. Citizens cannot book visits, and employees cannot work at all. Yet the cost of the alternative is far greater and often irreversible.
Where does the security chain usually break in companies?
The pattern of incidents is absolutely identical in almost all technical interventions. The first huge problem is an insufficiently segmented computer network. Workstations, servers and the public portal all sit in the same perimeter. You cannot isolate one part without automatically suspecting all the rest. The second common problem is the total lack of a dependency map. You do not know exactly which application really depends on a particular server. Without this list, the decision to shut down is always made on suspicion alone. So you are forced to shut down far more than necessary. The third serious problem is completely ineffective monitoring of the internal network. You have no centralised logs and no effective EDR solution. You cannot clearly prove the attacker's absence from a given digital system. What you cannot prove with certainty, you are legally obliged to shut down.
| Technical problem in the network | Dangerous effect in practice |
|---|---|
| Unsegmented internal network (flat network) | You cannot isolate a single zone. You are forced to shut down absolutely everything as a precaution. |
| No dependency map | The shutdown decision is made on suspicion alone. You quickly block services that were safe. |
| Ineffective IT monitoring | You cannot prove the hacker's absence. Reopening the systems will take whole weeks. |
Which measures completely change the outcome of a cyberattack?
Each vulnerability mentioned above has a very clear technical solution. Careful network segmentation makes the whole shutdown a surgical one. The system no longer goes down across absolutely the whole company. A map of technical dependencies massively reduces general panic and decision-making chaos. You no longer shut down everything at once just to be completely sure. Continuous EDR monitoring allows a service to be put back in just a few hours. You no longer have to wait whole days for safety confirmations. A written continuity plan saves you in moments of major crisis. It answers hard questions in the middle of the night when you are stressed. You know exactly how to keep production going with certain servers completely shut down.
What can you do concretely this week for your company?
Do not wait for a disastrous cyberattack to hit your business. Write down on one page your most important and vital services right away. Pick between three and five systems without which you cannot function. Identify very clearly which technical equipment each one depends on. Urgently ask your IT team what happens during a major incident. If one server is compromised, what else shuts down automatically? If the answer is "everything", you certainly have a major segmentation problem. Check whether VPN access always requires multi-factor authentication (MFA). Establish clearly who has the full authority to shut down a vital service. Ask the technical department for clear proof that the backup is perfectly isolated. Periodically test the procedures for quickly restoring all saved data. Talk to a security specialist before you have problems. An IT audit for companies is in fact the cheapest preventive exercise. We offer you cybersecurity solutions tailored perfectly to your company's needs. Visit our contact page today and secure iron-clad protection.