{"id":4991,"date":"2026-08-13T11:24:16","date_gmt":"2026-08-13T08:24:16","guid":{"rendered":"https:\/\/webembed.gr\/?p=4991"},"modified":"2026-08-13T11:55:41","modified_gmt":"2026-08-13T08:55:41","slug":"ransomware-at-eoppep-the-real-problem-is-bigger-than-the-attack","status":"publish","type":"post","link":"https:\/\/webembed.gr\/el\/ransomware-at-eoppep-the-real-problem-is-bigger-than-the-attack\/","title":{"rendered":"Ransomware at EOPPEP: The Real Problem Is Bigger Than the Attack"},"content":{"rendered":"

The recent ransomware cyberattack against EOPPEP is another reminder of something we often overlook:<\/strong><\/h3>\n

Cybersecurity is not only about technology. It is about people, processes, infrastructure, and organizational culture.<\/strong><\/p>\n

On August 5, 2026, EOPPEP was targeted by a ransomware-type cyberattack, affecting the operation of its network and information systems. The organization has stated that recovery activities are underway and that, according to its own assessment, the integrity of its files, registries, and data has been preserved.<\/p>\n

However, this incident deserves much more attention than simply being another example of a public-sector organization being attacked.<\/p>\n

Because ransomware is no longer just malware.<\/p>\n

It is a business and operational risk.<\/strong><\/p>\n

\"Hacked\"<\/p>\n

Ransomware Is Not Just “A Virus”<\/h3>\n

A modern ransomware attack usually does not begin when the victim sees:<\/p>\n

\n

“Your files have been encrypted.”<\/em><\/p>\n<\/blockquote>\n

That is often the final stage.<\/p>\n

Before that, attackers may spend days or weeks conducting reconnaissance, stealing credentials, gaining initial access, escalating privileges, moving laterally across the network and, in many cases, exfiltrating sensitive information.<\/p>\n

A typical attack chain can look like:<\/p>\n

Initial Access \u2192 Persistence \u2192 Privilege Escalation \u2192 Lateral Movement \u2192 Data Discovery \u2192 Exfiltration \u2192 Backup Destruction \u2192 Ransomware Deployment<\/strong><\/p>\n

This is why ransomware response cannot simply be:<\/p>\n

“Restore the backup and move on.”<\/strong><\/p>\n

Before recovery, much more important questions need to be answered:<\/p>\n

    \n
  • How did the attacker gain access?<\/li>\n
  • Which system was compromised first?<\/li>\n
  • Which credentials were used?<\/li>\n
  • How long did the attacker remain inside the environment?<\/li>\n
  • Which systems did they access?<\/li>\n
  • Did they access personal data?<\/li>\n
  • Was data exfiltrated?<\/li>\n
  • Were privileged accounts compromised?<\/li>\n
  • Were backups affected?<\/li>\n
  • Did the organization have sufficient logging to reconstruct the attack timeline?<\/li>\n<\/ul>\n

    These are questions for the SOC and IT teams, but also for management and the DPO.<\/p>\n

    \"Security\"<\/p>\n

    Ransomware and GDPR<\/h3>\n

    There is an important misconception about ransomware:<\/p>\n

    A ransomware attack does not automatically mean that personal data was leaked.<\/strong><\/p>\n

    However, a data breach does not require confirmed public disclosure of data either.<\/p>\n

    Under GDPR, a personal data breach can involve the destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to personal data.<\/p>\n

    Therefore, if ransomware encrypts personal data and makes it unavailable, there is already a potential GDPR issue that must be assessed.<\/p>\n

    If the attacker also copied the data before encrypting it, the situation becomes considerably more serious.<\/p>\n

    We may then have an incident affecting:<\/p>\n

    Confidentiality + Integrity + Availability.<\/strong><\/p>\n

    This is where the well-known 72-hour GDPR requirement<\/strong> becomes relevant.<\/p>\n

    When a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the data controller must generally notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.<\/p>\n

    Importantly, the organization does not necessarily need to have completed the entire forensic investigation within those 72 hours.<\/p>\n

    Initial notification and subsequent supplementary information can form part of the process.<\/p>\n

    This is why incident response and GDPR compliance cannot be treated as two completely separate processes.<\/strong><\/p>\n

    They must operate in parallel.<\/p>\n

    \"hacker-2\"<\/div>\n

    And Then We Reach a Bigger Problem: Legacy Systems<\/h3>\n
    \n

    The EOPPEP incident should not be used as an excuse to blame the people responsible for maintaining its infrastructure.<\/p>\n

    There is, however, a broader issue affecting a significant part of the public sector:<\/p>\n

    Legacy infrastructure.<\/strong><\/p>\n

    Information systems designed and implemented many years ago continue to support critical public services.<\/p>\n

    Being old does not automatically mean that a system is insecure.<\/p>\n

    The problem arises when a legacy system:<\/p>\n

      \n
    • is no longer supported by its vendor,<\/li>\n
    • cannot be easily upgraded,<\/li>\n
    • relies on outdated libraries or protocols,<\/li>\n
    • depends on obsolete operating systems,<\/li>\n
    • cannot integrate properly with modern security controls,<\/li>\n
    • provides limited logging,<\/li>\n
    • does not support modern authentication mechanisms,<\/li>\n
    • cannot effectively run modern EDR\/XDR solutions,<\/li>\n
    • or represents a critical dependency within a much larger information ecosystem.<\/li>\n<\/ul>\n

      This creates a vicious cycle.<\/p>\n

      We cannot upgrade it because it is old.
      \nWe cannot replace it because it is critical.
      \nWe cannot shut it down because it supports an essential service.
      \nSo we continue protecting it with infrastructure and processes that are also aging.<\/strong><\/p>\n

      This is technical debt.<\/p>\n

      But in cybersecurity, technical debt can become security debt<\/strong>.<\/p>\n

      \"Security-3\"<\/p>\n

      The Weakest Point May Not Be the System<\/h3>\n

      It may be the human being operating it.<\/p>\n

      And this is perhaps one of the most important lessons from every ransomware incident.<\/p>\n

      It is not enough to train the IT department.<\/p>\n

      A system administrator needs to understand:<\/p>\n

        \n
      • how ransomware operates,<\/li>\n
      • how lateral movement works,<\/li>\n
      • why Domain Admin accounts should not be used for everyday activities,<\/li>\n
      • how privileged credentials should be protected,<\/li>\n
      • why MFA matters,<\/li>\n
      • how to isolate a compromised endpoint,<\/li>\n
      • why backups should be immutable or offline,<\/li>\n
      • what logs need to be collected,<\/li>\n
      • and how suspicious behavior can be identified.<\/li>\n<\/ul>\n

        But the ordinary employee also needs to understand:<\/p>\n

          \n
        • what a phishing email looks like,<\/li>\n
        • why suspicious attachments should not be opened,<\/li>\n
        • why passwords should not be reused,<\/li>\n
        • why MFA matters,<\/li>\n
        • why unauthorized software should not be installed,<\/li>\n
        • when suspicious activity should be reported,<\/li>\n
        • and, most importantly:<\/li>\n<\/ul>\n

          Reporting a suspicious email is not “bothering IT.” It is a security control.<\/strong><\/p>\n

          \"Security-2\"<\/p>\n

          Responsibility Cannot Always Fall on the IT Administrator<\/h3>\n

          There is another issue that is often overlooked.<\/p>\n

          When an information system is 15 or 20 years old, an administrator can do an excellent job and still face serious technical limitations.<\/p>\n

            \n
          • They cannot install a security update that the application does not support.<\/li>\n
          • They cannot enforce MFA on an application that was designed before MFA became standard.<\/li>\n
          • They cannot deploy modern EDR on an unsupported operating system.<\/li>\n
          • They cannot fully isolate a system when it has to communicate with ten other legacy systems.<\/li>\n
          • They cannot replace a critical application without budget, time, planning, and management approval.<\/li>\n<\/ul>\n

            Therefore, cybersecurity is not exclusively a technical responsibility.<\/p>\n

            It is a management responsibility.<\/strong><\/p>\n

            Management determines how much cyber risk an organization is willing to accept.<\/p>\n

            \n
            \n<\/div>\n

            From Cybersecurity to Cyber Resilience<\/h3>\n

            Perhaps this is the most important lesson.<\/p>\n

            The goal cannot be:<\/p>\n

            “We must never be attacked.”<\/strong><\/p>\n

            That is unrealistic.<\/p>\n

            The goal should be:<\/p>\n

            “If we are attacked, we must detect it quickly, contain it, protect our data, and restore critical services in a controlled manner.”<\/strong><\/p>\n

            That is Cyber Resilience<\/strong>.<\/p>\n

            And for a public-sector organization, this is even more important.<\/p>\n

            When an organization’s information system goes down, it is not simply a company experiencing downtime.<\/p>\n

              \n
            • A public service may become unavailable.<\/li>\n
            • A citizen’s application may be delayed.<\/li>\n
            • A deadline may be affected.<\/li>\n
            • Administrative and financial costs may increase.<\/li>\n
            • And, in the worst-case scenario, citizens’ personal data may be compromised.<\/li>\n<\/ul>\n<\/div>","protected":false},"excerpt":{"rendered":"

              The recent ransomware cyberattack against EOPPEP is another reminder of something we often overlook: Cybersecurity is not only about technology. It is about people, processes, infrastructure, and organizational culture. On August 5, 2026, EOPPEP was targeted by a ransomware-type cyberattack, affecting the operation of its network and information systems. The organization has stated that recovery […]<\/p>\n","protected":false},"author":1,"featured_media":4999,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[96,86,79,216,217,102,158],"class_list":["post-4991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cyber-security","tag-cyberawareness","tag-cybersecurity","tag-gdpr","tag-hacking","tag-hacking-prevention","tag-ransomware"],"_links":{"self":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/comments?post=4991"}],"version-history":[{"count":5,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4991\/revisions"}],"predecessor-version":[{"id":5018,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4991\/revisions\/5018"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media\/4999"}],"wp:attachment":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media?parent=4991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/categories?post=4991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/tags?post=4991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}