Ministry of Social Cohesion and Family

Summary

The Greek DPA has imposed a fine of EUR 200,000 on the Ministry of Social Cohesion and Family. The ministry that was fined was responsible for the voucher programme for infant and child care centres, as well as another family support pilot programme. The voucher programme began in the 2014/15 school year. The controller contracted a government agency to run the IT systems. Between 1st and 5th March 2025, the IT system was subjected to a two-stage ransomware attack. A malicious third party encrypted the on-premises database and left a note stating that data had possibly been exfiltrated from it. The processor subsequently shut down the systems, which made it impossible to investigate the attack vector in-house. A total of 700,000 applications relating to 2.5 million individuals were affected, including children, parents, partners, legal representatives and employees of care providers. Furthermore, the family support pilot programme was affected for approximately 700 data subjects. The potentially exfiltrated and encrypted data included names, dates of birth, tax and social security numbers, disability status and certificates, foster or guardianship information, income data, nationality and residence permits, contact details, attendance times and IBANs. This vulnerability was well known and easily exploitable, so the risk was foreseeable. At the time of the attack, no processing agreement was in place. There had been no assessment by the controller of the processor's ability to offer sufficient security guarantees. The processor was fined aswell.