ENKR

E.E.T.A.A. childcare-programme ransomware, possible data leak

Add to my breach check

Made public · 2,500,000 people

What leaked11

Hard to replace

  • Income, balances, loans, credit or other financial details
  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Health information
  • National ID or tax number
  • Date of birth
  • Full name
  • Gender
  • Health informationdisability status and related certificates
  • National ID or tax numbertax number (AFM) and social security number · AMKA
  • Income, balances, loans, credit or other financial detailsincome and tax
  • Bank account numberIBAN of childcare providers' legal representatives and of 'Neighbourhood Nannies' beneficiaries
  • Mobile numbercontact details
  • Email addresscontact details
  • Full nameincluding father's and mother's names and children's names
  • Other profile datafamily and employment status, nationality and residence permits, foster or guardianship status, children's daily attendance times

To-dos5 · about 1 h 30 min in all

  1. If threatened: do not pay, keep the messages, report it to the policeabout 30 minfreeLimits harm from: extortion
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages, scam calls
  3. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next10 events

  1. Undetected 2 events2 days · show events
  2. Response 4 eventsNotice in 99 days · show events
  3. RemedyNone on record
  4. Penalty 4 eventsFine €200K · Back to latest
  5. DisputesNone on record

Penalty: 4 events

Back to latest
  1. Ministry and E.E.T.A.A. ordered to sign a GDPR Art. 28 processing agreement, and E.E.T.A.A. to complete its planned security measures, within one month
  2. Fine of 150,000 EUR on E.E.T.A.A. (Art. 32 and 28(3) GDPR)
  3. Fine of 200,000 EUR on the Ministry of Social Cohesion and Family (GDPR Art. 5(1)(f), 32 and 28(3))
  4. Security and processor-contract failings found; the ministry's breach notices were found compliant
Company
E.E.T.A.A. S.A.
When it happened
–
Company detected it
Made public
Notice
Possible leak
Affected
2,500,000 people · rough estimate; about 700,000 applications over 10 years to the childcare-voucher programme, plus about 700 people in the 'Neighbourhood Nannies' pilot; Hellenic DPA decision

How the facts developed

  1. Hellenic DPA decision 15/2026: ransomware encrypted and possibly exfiltrated the databases of two ministry programmes run by E.E.T.A.A.; the success of the attack was linked to outdated systems and inadequate security

Sources