Greek Data Protection Authority Fines EETAA and Ministry €350,000 After Ransomware Breach

Summary

Greece’s Data Protection Authority fined EETAA and the Social Cohesion Ministry €350,000 after a March 2025 ransomware attack exposed data concerning about 2.5 million people, citing weak security and missing processing agreements.

Key points

• The ransomware attack occurred in two phases from March 1–5, 2025, encrypting databases used for two public programs; the data may also have been uploaded or stolen.
• The affected records covered about 700,000 applications and 2.5 million people, including tax and social-security identifiers, contact and financial details, bank accounts, and disability-related information.
• The authority found that attackers exploited a known vulnerability in an outdated application server that EETAA had not addressed despite earlier warnings about its aging infrastructure.
• The authority held both EETAA, the processor, and the Social Cohesion and Family Ministry, the controller, responsible for security failures.
• It also found there was no valid Article 28 GDPR processing agreement between the parties for the childcare-center program at the time of the attack.
• The authority imposed fines totaling €350,000: €200,000 on the ministry and €150,000 on EETAA, and ordered them to sign the required agreement within one month.
• EETAA was separately ordered to complete and document planned security measures; the authority considered its post-attack system cleanup and restoration efforts adequate.