The Hellenic Data Protection Authority issued administrative fines and compliance orders following a large-scale personal data breach affecting information systems used by E.E.T.A.A. S.A. and the Ministry of Social Cohesion and Family Affairs.
Breach Findings
The Hellenic DPA investigated a large-scale personal data breach affecting databases containing identification and contact details, financial data, and health data. According to the Authority, the Ministry of Social Cohesion and Family Affairs complied with its obligations to notify the breach and communicate with affected data subjects.
However, the Authority found that the success of the attack was associated with E.E.T.A.A.’s continued use of outdated information systems and inadequate security measures, despite its awareness of the risks. The DPA identified infringements relating to security of processing and deficiencies under Article 28 GDPR.
Fines and Orders
The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A. The final decision was issued on July 28, 2026.
The Authority ordered both the Ministry and E.E.T.A.A. to enter into a data processing agreement pursuant to Article 28 GDPR and to fully implement planned measures to strengthen their information system security.
What to do
- Enter into a data processing agreement pursuant to Article 28 GDPR.
- Fully implement the planned measures to strengthen the security of their information systems.
Key facts and where they come from
- The Hellenic DPA imposed a fine of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs.
The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A.
- E.E.T.A.A. received an administrative fine of EUR 150 000 from the Hellenic DPA.
The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A.
- The breach affected databases containing identification, contact, financial, and health data.
The breach affected databases containing personal data of a large number of data subjects, including identification and contact details, financial and health data.