Reported by
Constantin Moldovan
Public Record
Bianca Albu
Public Record
More than 80 Romanian public institutions continued to purchase <a href="https://bitcomme.com/gillette-cybersecurity-duo-on-mission-to-stop-cyber-hackers-from-destroying-lives/” title=”Gillette Cybersecurity Duo On Mission To Stop Cyber-Hackers From Destroying Lives”>cybersecurity software from a Russian-founded company after the government explicitly banned its use over national security concerns, a review of public procurement records reveals.
Following Russia’s full-scale invasion of Ukraine, Romania passed a 2022 law prohibiting public entities from acquiring cybersecurity software originating fromRussian individuals or entities. In March 2023, a government order officially blacklisted a broad range of products from Kaspersky, a Russian cybersecurity firm.
However, procurement data shows that between March 2023 and September 2026, 83 public institutions and authorities made 131 purchases of prohibited software.
In an emailed statement, Kaspersky said it “does not have any inappropriate ties to any government.”
“Kaspersky has maintained that the claims about alleged security risks that the company’s products might have and related restrictions are based on the current geopolitical climate rather than a technical analysis of Kaspersky software security,” the company said.
“To date, no party has presented any public evidence that the company’s products might pose a threat to corporate or private users,” Kaspersky added.
The Romanian buyers of Kaspersky software included hospitals, municipal governments, schools, and other public institutions.
Notably, less than two months after the blacklist was published, the National Institute for Laser, Plasma and Radiation Physics bought two-year Kaspersky antivirus licenses for three devices. According to its annual reports, the research institute generates classified information and works under contracts with the Ministry of National Defense, the “Ferdinand I” Military Technical Academy, and NATO.
“We would like to clarify that the purchased product has never been installed or actually used on any computer, server, or other IT system belonging to the institute,” the institute said in an emailed response to questions.
Sebastian Burduja, who headed Romania’s Ministry of Research, Innovation and Digitalization when the rules were introduced, attributed the continued purchases to a lack of enforcement staff.
“On the other hand, as we all suspect, we likely have a pro-Russian strain within Romanian state institutions,” said Burduja said, who is now a deputy in the country’s parliament.
Kaspersky is named after its founder, Eugene Kaspersky, a former software engineer for the Soviet Union Defense Ministry who studied mathematics at a school sponsored by state authorities like the KGB, the secret police and intelligence agency. From its founding in 1997, Kaspersky grew into one of the world’s largest cybersecurity providers. But the company’s business has been hampered by international restrictions, including a 2024 action by several countries.
The U.S. prohibited the sale of many Kaspersky products, citing risks to national security. The company rejected the allegations, claiming the ban was based on the “geopolitical climate and theoretical concerns” rather than product integrity.
Germany, Lithuania, and Italy have also issued formal warnings or implemented measures to phase out the software from critical infrastructure.
Under Romanian law, violating the ban on Kaspersky products is an administrative offense carrying fines between 50,000 and 200,000 lei (between $10,500 and $42,000).
