On 11 November 2026, Romania's Intelligence Service (SRI) said that its National Cyberint Center had identified a compromise of a national-level government institution by the Russian actor APT Turla in December 2025. SRI said the attackers exploited "systemic vulnerabilities" in Microsoft operating systems, that the attack was stopped, that the affected email service was remediated, and that "no exfiltration of sensitive data was identified." The statement followed ESET's report on a new Turla toolkit, Cereal, which compromised government Exchange servers in Romania and Kazakhstan.
The operational story is a success. The policy story is less comfortable.
What is actually established
The two accounts overlap but are not identical, so it helps to separate them.
SRI's release names no institution, gives no CVEs, and does not mention Exchange. It says the intrusion was detected in December 2025, countered by the Cyberint Center, and shared with the legal beneficiaries and with European, EU and NATO partners. It adds that investigations into other Russian-linked campaigns continue.
As relayed by The Record, ESET describes Cereal as a previously unknown toolkit that lets attackers monitor email traffic, collect selected messages and keep access to compromised Microsoft Exchange servers. In Romania it was configured to collect mail to and from NATO and EU institutions. ESET reportedly found no external command-and-control infrastructure, because each compromised server acted as its own relay. ESET could not determine how the attackers got in or how much data they took.
Neither source confirms that the SRI incident and ESET's Romanian victim are the same organisation. Treat that link as likely but unproven. Also, a collection rule aimed at NATO and EU addresses shows what the malware was built to harvest. It does not show that NATO or EU systems were breached.
The case for tougher rules
The strongest argument for stricter regulation is that this campaign looks like the failure mode regulators fear most. It was long-term, stealthy and aimed at a trusted correspondence channel, and the disclosure arrived about eleven months after detection. A state that believes its allies' mail is being read through its own systems may reasonably argue that allies have a right to know sooner. Binding obligations, it would say, are the only way to make that happen. The EU has already moved this way. The NIS2 Directive (Directive (EU) 2022/2555) requires essential and important entities to give an early warning within 24 hours of becoming aware of a significant incident. It also requires an incident notification within 72 hours and a final report within one month of that notification. Member States were due to transpose it by 17 October 2024.
Why the lag is not the scandal it looks like
The 24 and 72-hour clocks run to national CSIRTs and competent authorities, not to the public. SRI says it informed the legal beneficiaries and its European and NATO counterparts. By the account it gave, the channels that matter operationally were used. Public disclosure of a still-contained intrusion can also tip off an adversary or compromise an investigation. SRI says other related operations remain under investigation, which is exactly the situation where early publicity has costs.
So the right critique is narrower than "Romania was slow." The gap between operational notification and public learning is wide, and it was closed by a vendor rather than by a rule or a public record. The ENISA Threat Landscape 2025, which analysed 4,875 incidents between 1 July 2024 and 30 June 2025, shows how much of the EU's picture of threats depends on whatever gets reported and aggregated. If vendors are the main way the public finds out about state-backed intrusions, the public picture will track vendor telemetry and vendor timing.
What proportionate policy looks like
Three implications follow, and none requires new prohibitions.
First, publish a delayed, structured summary of significant state-linked incidents. After containment and partner notification, a sector, a month and a technique class would be enough. This keeps investigations safe while giving defenders and researchers data that does not depend on a vendor's research calendar. It builds on reporting channels NIS2 already created and adds no new compliance burden for operators.
Second, put the effort into hardening the thing that failed, not into vendor bans. The common thread here is an attacker living inside mail infrastructure, in ESET's account Microsoft Exchange servers, and SRI points to Microsoft system vulnerabilities. Calls to exclude US vendors from public procurement, or to mandate sovereign mail stacks, would trade a known-risk platform for migration risk, thinner security staffing and new bugs. Timely patching, monitored mail servers, and logging that lets a small team spot a rogue service are cheaper and better evidenced. Security-by-design duties on software vendors are a fairer lever than blunt exclusion, provided they are tied to demonstrable outcomes.
Third, protect the researchers and the open information flow. This episode surfaced because a private firm published its findings, and the government then confirmed and added detail. A regime that chills vulnerability and threat research, through liability fears or heavy-handed disclosure mandates, would make the EU less informed about hostile activity. Strong defence and open publication are complements.
The bottom line
Romania's response, as SRI describes it, is what the EU wants from a member state: detection, containment, remediation and partner notification, all within weeks. What remains unresolved is how citizens and allies learn about it. The credible fix is predictable, delayed public reporting of state-linked incidents, plus attention to the dull but decisive work of securing mail servers. Sweeping new mandates, and doubts about whether the existing ones work, are the wrong response. NIS2 has been in force long enough that the Commission should publish what its reporting channels are producing. That data would show whether the Romanian case is typical, and whether faster or fuller disclosure is needed at all.