In short
- Buyers included hospitals, municipal governments, schools, and a research institute generating classified information.
- Violating the ban carries fines between 50,000 and 200,000 lei (between $10,500 and $42,000).
What happened
Despite a 2022 law and a March 2023 government order blacklisting Kaspersky products, Romanian procurement records show 83 public institutions made 131 purchases of prohibited Russian cybersecurity software between March 2023 and September 2026. Buyers ranged from hospitals and schools to a research institute working with the Ministry of National Defense and NATO.
The National Institute for Laser, Plasma and Radiation Physics bought Kaspersky licenses less than two months after the blacklist, but claimed the software was never installed or used. The Ministry of Research, Innovation and Digitalization cited lack of enforcement staff and possible pro-Russian sentiment within state institutions as reasons for continued purchases.
In numbers
- 83 Romanian public institutions making purchases
- 131 purchases of prohibited software
Designated in this action
What compliance teams should check
- Review procurement records for purchases of Kaspersky products by Romanian public institutions between March 2023 and September 2026.
- Verify compliance with the March 2023 government blacklist and 2022 law prohibiting Russian-origin cybersecurity software.
- Assess risk exposure in institutions generating classified information or working with the Ministry of National Defense and NATO.
Why it matters
This story highlights significant gaps in enforcement of national security-related bans on Russian cybersecurity software, raising concerns about potential vulnerabilities in critical Romanian public institutions. Compliance officers must ensure strict adherence to government blacklists and laws, especially where sensitive or classified information is involved. The continued purchases despite explicit prohibitions and substantial fines underscore the need for robust monitoring, clear procurement controls, and awareness of geopolitical risks in software supply chains.
Catch stories like these on your own customers.
complead screens your customers against adverse media, sanctions and PEP lists, and re-checks them every day. When a name you hold turns up in the news, it lands in your case queue with the evidence attached.
Procurement records reveal that 83 public entities — including a defense and NATO research contractor — purchased cybersecurity products from the Russian company Kaspersky after it was blacklisted over national security concerns.OCCRP, 16 Oct 2026, 10:54 UTC, occrp.org