Event Intelligence
Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs
Cyber attackBreaking Updated 8th October 2026 · 18:20
- Significance
- Material
- Impact
- Strongly Negative
- Confidence Confidence indicates how reliable ProcIntel considers the event assessment based on the quality, quantity and independence of the supporting evidence. It does not measure the event's importance.
- High
- Evidence
- 1 source 1 signal
Overview
What happened Source facts
Background information Date of final decision: 28/07/2026 National case Controller: Ministry of Social Cohesion and Family Affairs Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Compliance order, Summary of the Decision Origin of the case The Hellenic Data Protection Authority (DPA) investigated a large-scale personal data breach affecting the information systems of the Hellenic Agency for Local Development and Local Government (E.E.T.A.A.) S.A., which were used to implement programmes of the Ministry of Social Cohesion and Family Affairs. Key Findings The breach affected databases containing personal data of a large number of data subjects, including identification and contact details, financial and health data. The Hellenic DPA found that the Ministry of Social Cohesion and Family Affairs, in its capacity as controller, had complied with its obligations concerning the notification of the breach to the Authority and its communication to the affected data subjects. However, the Authority found that the success of the attack was associated with E.E.T.A.A.’s continued use of outdated information systems and inadequate security measures, despite its awareness of the relevant risks. The DPA found infringements of the requirements relating to the security of processing, as well as deficiencies in compliance with the requirements of Article 28 GDPR governing the relationship between the controller and the processor. Decision The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A. It also ordered the parties (i.e. the Ministry and E.E.T.A.A.) to enter into a data processing agreement pursuant to Article 28 GDPR and to fully implement the planned measures to strengthen the security of their information systems. For further information: Decision on an incident of personal data breach of EETAA in his capacity as a processor on behalf of the data controller of YKOISO (EL)
Suggested considerations
Derived from this Event's rating and type — prompts for your team to evaluate, not reported facts and not recommendations.
- Monitor for explicit timing evidence.
- Determine whether internal exposure warrants earlier investigation.
Date evidence from the source: “<div class="heading-wrapper"><h2 id="background-information">Background information</h2><ul><li>Date of final decision: 28/07/2026</li><li>National case</li><li>Controller: Ministry of Social Cohesion and Family Affairs</li><li>Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject)</li><li>Decision: Administrative fine, Compliance order, </li></ul></div><div class="heading-wrapper"><h2 id="summary-of-the-decision">Summary of the Decision</h2><h3>Origin of the case </h3><p>The Hellenic Data Protection Authority (DPA) investigated a large-scale personal data breach affecting the information systems of the Hellenic Agency for Local Development and Local Government (E.E.T.A.A.) S.A., which were used to implement programmes of the Ministry of Social Cohesion and Family Affairs.</p><h3>Key Findings</h3><p>The breach affected databases containing personal data of a large number of data subjects, including identification and contact details, financial and health data.”
Suggested Considerations
These are prompts for a procurement team to evaluate, generated from this Event's rating and type. They are not reported facts and not instructions — ProcIntel does not know your contracts, suppliers or exposure.
- Monitor for explicit timing evidence.
- Determine whether internal exposure warrants earlier investigation.
How to read this Event
- Source facts what the original source reported.
- ProcIntel assessment ProcIntel's own interpretation of those facts.
- Consideration a suggested question for your team — never a recommendation to act.
Source Facts
Only what the sources reported. Nothing on this page is ProcIntel's interpretation.
Recorded source facts
Background information Date of final decision: 28/07/2026 National case Controller: Ministry of Social Cohesion and Family Affairs Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Compliance order, Summary of the Decision Origin of the case The Hellenic Data Protection Authority (DPA) investigated a large-scale personal data breach affecting the information systems of the Hellenic Agency for Local Development and Local Government (E.E.T.A.A.) S.A., which were used to implement programmes of the Ministry of Social Cohesion and Family Affairs. Key Findings The breach affected databases containing personal data of a large number of data subjects, including identification and contact details, financial and health data. The Hellenic DPA found that the Ministry of Social Cohesion and Family Affairs, in its capacity as controller, had complied with its obligations concerning the notification of the breach to the Authority and its communication to the affected data subjects. However, the Authority found that the success of the attack was associated with E.E.T.A.A.’s continued use of outdated information systems and inadequate security measures, despite its awareness of the relevant risks. The DPA found infringements of the requirements relating to the security of processing, as well as deficiencies in compliance with the requirements of Article 28 GDPR governing the relationship between the controller and the processor. Decision The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A. It also ordered the parties (i.e. the Ministry and E.E.T.A.A.) to enter into a data processing agreement pursuant to Article 28 GDPR and to fully implement the planned measures to strengthen the security of their information systems. For further information: Decision on an incident of personal data breach of EETAA in his capacity as a processor on behalf of the data controller of YKOISO (EL)
This Event rests on a single report. It has not been corroborated by a second, independent source.
-
Background information Date of final decision: 28/07/2026 National case Controller: Ministry of Social Cohesion and Family Affairs Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Compliance order, Summary of the Decision Origin of the case The Hellenic Data Protection Authority (DPA) investigated a large-scale personal…
Open original report → edpb.europa.eu
Linked Signals
Every collected Signal that contributed to this Event, with how it was matched.
| Published | Headline | Source | Matched text | Extraction confidence | Method |
|---|---|---|---|---|---|
| 8th October 2026 | Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs | EDPB News RSS | data breach | 95.0 | high precision phrase |
Why ProcIntel Rates This
Every rating below is produced from the logged facts by consistent, rules-based scoring — never from the tone or wording of the source.
Significance Significance estimates the potential procurement impact of the event, including factors such as supply, cost, operations, geography and strategic importance.
3 · Material- This type of disruption typically has a moderate procurement impact.
- No specific geography identified yet.
- No specific organisation linked yet — geographies, commodities and routes do not count as organisations.
- No procurement category has been determined for this event.
- Time horizon is not yet assessed for individual Events; a standard short-term assumption is used.
Confidence Confidence indicates how reliable ProcIntel considers the event assessment based on the quality, quantity and independence of the supporting evidence. It does not measure the event's importance.
4 · High- Reported by at least one primary/official source.
- Reported by a single source so far — not yet independently corroborated.
- Key facts (what happened, when) are fully documented.
- Evidence was last updated within the last month.
Urgency How soon the evidence already identified for this event suggests action may be needed. Unknown means no sufficiently explicit or quantified timing evidence has been identified -- ProcIntel never infers a timeframe where the evidence does not support one.
UnknownTiming not established. No sufficiently explicit or quantified timing evidence has been identified. Procintel has not inferred urgency where timing evidence is insufficient.
Impact Direction Whether the procurement impact of this development is assessed as negative, positive, or neutral/mixed.
Strongly NegativeProvisional default — not yet reviewed.