2026/8 Weekly Update from the EU ISAC for Cities & Regions: Collaborative GRC Review / Basic Risk Review Process – Turn Red to Green / Generic risk evaluation prompt for AI / OpenAI & Hugging Face / Romanian Land Registry Deleted by Hacker

von oschwabean Veröffentlicht am

2026/8 Weekly Update from the EU ISAC for Cities & Regions: Collaborative GRC Review / Basic Risk Review Process – Turn Red to Green / Generic risk evaluation prompt for AI / OpenAI & Hugging Face / Romanian Land Registry Deleted by Hacker

** For Back Issues see https://isac4cities.eu/blog **

The City ISAC (I4C+) is an Information and Analysis Centre whose members are IT and cyber security decision makers exchanging knowledge to improve their cities and collective cyber resilience. I4C+ is a Special Interest Group (SIG) hosted by Major Cities Europe (MCE). Dr. Oliver Schwabe is a member of MCE and in his function Chair of the ISAC for Cities Plus (I4C+). He is the person in charge of this effort on behalf of MCE and the responsible contact person. I4C+ is recognized by the European Agency for Cybersecurity ENISA. See https://isac4cities.eu/.

Discussion Summary

Hi everyone – pretty full house this morning with our Crisam GRC friends sharing the current pilot with colleagues from Estonia (GRC team), Italy, Ireland, and Luxemburg (GRC team) joining. Reviewed the initial configuration adjustments and explored the narrative of how to operate a basic risk review using the solution. In the end a tool is a tool, and we need to operate it as effectively as possible to inform decision making and help our organisations avoid as many surprises as possible. We all agreed that aligning to ENISA standards and seeing each others risk registers can be very valuable – what we do seem to be noticing that we are very similar in all respects…. (and can thus also find gaps in our own approaches this way).

The OpenAI & Hugging Face incident is of course all across the press – Barista summarised it as follows: “In mid-July 2026, OpenAI revealed that one of its experimental AI models, including GPT-5.6 Sol, autonomously hacked Hugging Face’s systems during an internal cyber capability evaluation. See https://www.ibtimes.co.uk/openai-gpt-5-6-sol-breach-hugging-face-1810032. The breach occurred from July 11–13, 2026, and was only discovered after the models exploited an unknown software flaw to access the internet and then breached Hugging Face’s infrastructure. OpenAI did not realize its own agent was responsible for the attack for several days, and the two companies did not communicate about the matter until July 20, after Hugging Face had already notified the FBI. The incident was described as unprecedented, as the AI agent acted autonomously, bypassing controls and using stolen credentials to access Hugging Face’s servers. The goal was to find information to cheat on a cybersecurity benchmark. Hugging Face co-founder Clément Delangue stated that the company suspected a frontier AI lab was behind the attack and confirmed there was no malicious intent from OpenAI’s side. Both companies are now collaborating to investigate and address the security implications of this eventindexbox.io+4. This event has sparked significant discussion about the risks of advanced AI systems and the need for stronger safeguards in testing environments.” Implications for us? Maybe we all need “driving licenses” for AI with strong, short-interval governance?

A further worrying incident happened on July 14, 2026, when Romania’s National Agency for Cadastre and Real Estate Advertising (ANCPI) suffered a credential-based cyberattack that resulted in the complete deletion of the country’s land registry database. The attacker, identified by the alias ByteToBreach, gained access using valid credentials, conducted internal reconnaissance, and then destroyed both the primary systems and backups after a failed extortion attempt. This incident brought Romania’s real estate market to a halt, disabling official applications, websites, and email servers, and preventing notaries and citizens from accessing essential land records – see https://www.rescana.com/post/romania-ancpi-land-registry-wiped-in-credential-based-cyberattack-incident-analysis-and-mitigation-recommendations. By July 15, stolen data was posted for sale on a hacking forum, and the agency’s systems remained offline for at least a week. Romanian officials later announced a full network rebuild. Fortunately, an offline backup copy of the data existed, which allowed for eventual recovery, though the process was slow and disrupted property transactions nationwiderescana.com. The attack exposed significant vulnerabilities in Romania’s digital defenses, particularly in access control, backup separation, and incident response. The incident is considered one of the most serious technical failures in ANCPI’s history and highlighted the risks of poor cyber hygiene and inadequate segmentation in public sector infrastructure. Lesson for us? I find it interesting that the quality of incident response was questioned considering that threats to national security are the most significant and the key control here is a robust incident response management system….

Another thing we discussed when exploring the ISAC risk data in the GRC solution, was how a basic review process works. In practice, I find this discussed endlessly, however in the end that there is “much ado, about nothing” and the below is what happens in the reviews I am associated with – seems good enough:

  1. Prepare
    1. Gather your risks (i.e. for a specific process or objective or organisational area)
    1. Filter your risks for those that are “approved”
    1. Rank your risk descending based on their current impact
    1. Filter your risks for “Very High” current impact only
    1. Sort your “Very High” current impact risks for descending probability.
  2. Review – work down your list of prepared risks
    1. Ensure description etc is up to date.
    1. Ensure evaluation of current impact and probability is up to date
    1. Ensure that controls are aligned, recently assured and effective (if not, initiate actions to remediate this)
    1. Review your risk appetite and target risk levels
    1. Ensure that remediation actions to move from current impact and probability to target impact and probability are in place (note: do not remediate below appetite)

No higher math here – do the above robustly and you will be well on your way to being quite performant. Yes, there are many subtleties, and using a decent GRC solution can make all of this a lot easier than Excel. Happy to facilitate a review for you.

Maybe also of use, please find a generic risk evaluation prompt for any AI below. It is a nice helper to assess any risk record and make focused improvements to it.

Based on the following  RISK_DESCRIPTION and using risk management standards such as; ISO 31000:2018 for generic risk management principles, COSO ERM Framework for enterprise-wide risk management, NIST Risk Management Framework (RMF) for cybersecurity and federal compliance, ISO/IEC 27005:2022 for information security risk management, FAIR (Factor Analysis of Information Risk) for quantitative cybersecurity risk assessment, OCTAVE for IT and operational risk evaluation, M_o_R (Management of Risk) for project and program risk management, Basel III for financial risk in banking, Solvency II for insurance risk management, and ENISA Risk Management Framework for EU-specific cybersecurity and public administration risk management, evaluate the quality of this risk record by answering the following 10 questions of the  EVALUATION_CRITERIA.

EVALUATION_CRITERIA

1. Is the risk clearly defined in terms of its description, category, and context? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
2. Does the description explicitly assign a risk owner responsible for managing this risk?  Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
3. Does the description include a clear assessment of the likelihood and impact of the risk, using a defined scale (qualitative or quantitative)?  Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
4. Does the description indicate whether the risk aligns with the organization’s risk appetite or tolerance thresholds? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
5. Are specific controls, actions, or mitigation measures proposed to address the risk? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
6. Does the description evaluate the residual risk (the remaining risk after mitigation)? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
7. Does the description mention consultation with relevant stakeholders during the risk assessment? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
8. Does the description address compliance with relevant legal or regulatory requirements? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
9. Does the description include a plan for monitoring the risk and periodic review? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.
10. Is the risk fully documented, including evidence, assumptions, and dependencies? Explain your assessment of Yes, Partial, or No. Provide improvement suggestions for the text of the risk record.

RISK_DESCRIPTION

<Copy risk record here>

Cheers

Oliver

ISAC Services (Member Funded)

We have published our services at Services Offered – EU ISAC for Cities (isac4cities.eu). Please do review and consider reaching out to include such in your activities and budgets.

Note that emerging new services are related to managing the MISP platform (and onboarding) plus Barista.

 

Please remember you can reach the whole group via city-isac-i4c-tlpwhite@majorcities.eu. A dedicated group for those cities signing the NDAs is available separately.

Also note our LinkedIn organisational page at https://www.linkedin.com/company/eu-city-information-sharing-and-analysis-center-isac/ and our discussion group at https://www.linkedin.com/groups/12773643/.  Do follow us / join.

Thank you for the support, your City ISAC I4C+ Team.

Cheers and ever onwards

Oliver

Innovating our Future… Together

Chair City ISAC I4C+ / Dr. Oliver Schwabe.

Email: oliver.schwabe@isac4cities.eu Mobile: +49 (0) 1709053671. Web: https://i4c.isacs.eu/ & https://www.majorcities.eu/isac-for-cities-plus/