Hellenic Agency for Local Development and Local Government S.A. (EETAA)

Summary

The Greek DPA has imposed a fine of EUR 150,000 on the Hellenic Agency for Local Development and Local Government S.A. (EETAA). The entity that was fined ran the IT system for the Infant and Child Care Centres voucher programme and another family support pilot programme as a processor. The voucher programme began in the 2014/15 school year. From 1st to 5th March 2025, the IT system was subject to a two-stage ransomware attack. A malicious third party encrypted the on-premises database and left a note stating that data had possibly been exfiltrated from the database. The processor subsequently shut down the systems, making it impossible to investigate the attack vector in-house. A total of 700,000 applications concerning 2.5 million data subjects were affected, including children, parents, partners, legal representatives, and employees of care providers. Furthermore, approximately 700 data subjects were affected by the family support pilot programme. The encrypted and potentially exfiltrated data included names, dates of birth, tax and social security numbers, disability status and certificates, foster or guardianship information, income data, nationality and residence permits, contact details, attendance times and IBANs. This vulnerability was well-known and easily exploitable, so the risk was foreseeable. At the time of the attack, no processing agreement was in place. The processor could not prove that they had informed the ministry, acting as the data controller, of these circumstances. The Ministry of Social Cohesion and Family was also fined for the event.