[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnbam0cY69wGwehvpeP03Cp61elJMsuhScZKoRR8XvrU":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c93d6599-225e-4d89-a067-a3275c8ba45c","HDPA (Greece) - 15\u002F2026","hdpa-greece-15-2026-6194f4","← Older revision Revision as of 09:56, 8 September 2026 Line 105: Line 105: During the breach, the databases supporting the implementation of two initiatives were encrypted and possibly downloaded\u002Fstolen. This included the data of staff, the legal representatives of the organisation, the applicants, and the beneficiaries (which included children) affecting a total of approximately 2,500,700 data subjects. The breach also allowed for unauthorised persons to gain access to the data held by the processor, and disruption of the systems. During the breach, the databases supporting the implementation of two initiatives were encrypted and possibly downloaded\u002Fstolen. This included the data of staff, the legal representatives of the organisation, the applicants, and the beneficiaries (which included children) affecting a total of approximately 2,500,700 data subjects. The breach also allowed for unauthorised persons to gain access to the data held by the processor, and disruption of the systems. The controller underscored that it merely acted as the program beneficiary, and the affected systems belonged to the processor who was in charge of actually implementing the program, blaming the incident on the processor. The controller further claimed that upon noticing the breach they immediatly acted in compliance with the GDPR, notifying both the DPA and the processor, and took all necessary measures to restore the availability of the systems, and minimise the impact on data subjects. The controller underscored that the affected systems belonged to the processor who was in charge of actually implementing the program, blaming the incident on the processor. The controller further claimed that upon noticing the breach they immediately acted in compliance with the GDPR, notifying both the DPA and the processor, and took all necessary measures to restore the availability of the systems, and minimise the impact on data subjects. The processor maintained that they could not stop the processing in light of the public interest, and made apparent that they were made aware of the risks that their systems pose, and the need for their information system technologies to be improved and updated. The processor claimed that they contacted the controller and other ministries to secure the necessary resources to allow the processor to address the vulnerabilities of its system. The processor emphasised it didn’t have the necessary financial resources to modernise the information systems, which was dependent entirely on state funding. The processor maintained that they could not stop the processing in light of the public interest, and made apparent that they were made aware of the risks that their systems pose, and the need for their information system technologies to be improved and updated. The processor claimed that they contacted the controller and other ministries to secure the necessary resources to allow the processor to address the vulnerabilities of its system. The processor emphasised it didn’t have the necessary financial resources to modernise the information systems, which was dependent entirely on state funding.","Greece's Hellenic Data Protection Authority (HDPA) has imposed fines totaling €350,000 on two entities for GDPR violations related to a data breach. The breach, which affected approximately 2.5 million individuals, involved the encryption and potential exfiltration of sensitive data. The controller blamed the processor, citing system vulnerabilities and lack of funding for necessary upgrades, while the processor highlighted public interest and reliance on state funding for modernization.","Greece's HDPA fines two entities €350K for GDPR violations following a data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_15\u002F2026&diff=52944&oldid=52942","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-09-08T09:56:52+00:00","2026-09-08T10:00:13.925103+00:00",7,[17],{"name":18,"type":19},"HDPA","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":134},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":77,"name":78,"problem":79,"products":80},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":106,"name":107,"problem":108,"products":109},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":153},"350000-gdpr-fine-after-breach-exposes-25-million-records-in-greece","€350,000 GDPR Fine After Breach Exposes 2.5 Million Records in Greece","The HDPA imposed significant fines on both a data controller and processor following a breach that encrypted and potentially exfiltrated sensitive data belonging to approximately 2.5 million individuals. The root failure lies in unpatched system vulnerabilities left unaddressed due to budget constraints and inadequate modernization — excuses that carry no legal weight under GDPR. Critically, the controller-processor relationship lacked proper accountability structures, with each party deflecting responsibility rather than maintaining joint due diligence. This case reinforces that GDPR obligations cannot be waived on grounds of funding shortfalls, and both controllers and processors share enforceable responsibility for technical safeguards. The scale of the breach and the regulatory response highlight that neglecting vulnerability management in public-sector or state-funded environments poses enormous legal and reputational risk.",[140,141,142,143,144,145,146,147,148,149,150,151,152],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 28 – Processor obligations and contractual requirements","GDPR Article 32 – Security of processing \u002F technical and organisational measures","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 83(4)\u002F(5) – Administrative fines","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 CA-3 – Information Exchange","CIS Control 7 – Continuous Vulnerability Management","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 8.8 – Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Annex A 5.19 – Information security in supplier relationships",{}]