[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8uW_5zbSsWZBdZ3qrMfGrx1I13bOoP-BpFV841tUj8s":3},{"article":4,"iocs":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"edfe6a21-a47d-4191-9333-b312c2f1571b","HDPA (Greece) - 14\u002F2026","hdpa-greece-14-2026-69b977","← Older revision Revision as of 07:30, 19 August 2026 Line 101: Line 101: After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with [[Article 34 GDPR]] since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with [[Article 34 GDPR]] since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. The HOU took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with [[Article 33 GDPR]]. The controller took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with [[Article 33 GDPR]]. === Holding === === Holding === The DPA held that the controller complied with its notification obligations under Article 33 and [[Article 34 GDPR]], despite the initial notification being supplemented at a later time. The DPA held that the controller complied with its notification obligations under Article 33 and [[Article 34 GDPR]], despite the initial notification being supplemented at a later time.","The Hellenic Open University experienced a ransomware attack that compromised the personal data of 30,000 individuals, with 813 GB of data leaked onto the dark web. The Greek Data Protection Authority (DPA) ordered the university to implement improved authentication and administrator training. The DPA found the university complied with GDPR notification obligations despite initial delays.","Greek university fined for ransomware attack impacting 30,000 individuals.","Help HDPA (Greece) - 14\u002F2026: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:04, 19 August 2026 view sourceSf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators11 editsmTag: Visual edit← Older edit Latest revision as of 07:30, 19 August 2026 view source Sf (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators11 editsmTag: Visual edit Line 101: Line 101: After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with [[Article 34 GDPR]] since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with [[Article 34 GDPR]] since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. The HOU took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with [[Article 33 GDPR]]. The controller took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with [[Article 33 GDPR]]. === Holding ====== Holding === The DPA held that the controller complied with its notification obligations under Article 33 and [[Article 34 GDPR]], despite the initial notification being supplemented at a later time.The DPA held that the controller complied with its notification obligations under Article 33 and [[Article 34 GDPR]], despite the initial notification being supplemented at a later time. Latest revision as of 07:30, 19 August 2026 HDPA - 14\u002F2026 Authority: HDPA (Greece) Jurisdiction: Greece Relevant Law: Article 32 GDPR Article 33 GDPR Article 34 GDPR Article 58(2)(d) GDPR Type: Complaint Outcome: n\u002Fa Started: Decided: 15 July 2026 Published: Fine: n\u002Fa Parties: n\u002Fa National Case Number\u002FName: 14\u002F2026 European Case Law Identifier: n\u002Fa Appeal: n\u002Fa Original Language(s): Greek Original Source: ΑΡΧΗ ΠΡΟΣΤΑΣΙΑΣ ΔΕΔΟΜΕΝΩΝ (in EL) Initial Contributor: sf The DPA ordered a university to implement improved authentication measures as well as targeted training plans for system administrators after the university was subject to a ransomware attack affecting the personal data of 30,000 individuals. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The Hellenic Open University (‘the controller’) submitted initial and supplementary notifications to the DPA after it was subject to a data breach resulting from a ransomware attack. The breach affected the personal data of 30,000 individuals in the controller’s information system and involved a leak of 813 GB of personal data that was later posted on the dark web but with restricted access as to its content. After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with Article 34 GDPR since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. The controller took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with Article 33 GDPR. Holding The DPA held that the controller complied with its notification obligations under Article 33 and Article 34 GDPR, despite the initial notification being supplemented at a later time. Regarding the controller’s compliance with Article 32 GDPR (i.e. the obligation to implement adequate security measures), the DPA held that the cause of the incident was a human error, which could have been prevented through targeted training and improved authentication measures with individuals which have access to the system administration. In accordance with Article 58(2)(d) GDPR, the DPA ordered the controller to implement targeted training plans for system administrators and to fully implement the security measures mentioned above, within 6 months of this decision and to inform the DPA of such. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. Athens, July 15, 2026 Ref. No.: 3164 DECISION 14\u002F2026 The Data Protection Authority (hereinafter the “Authority”), met, following an invitation from the acting Chair, Deputy , Georgios Batzalexis, for a meeting via teleconference on November 4, 2025, in order to examine the case referred to in the background section of this decision. Present at the meeting were the Authority’s Deputy Chair, Georgios Batzalexis, and the regular members Spyridon Vlachopoulos, Konstantinos Lambrinoudakis, Charalambos Anthopoulos, Christos Kalloniatis, and Katerina Iliadou, as well as the alternate members Demosthenes Vougioukas, serving as rapporteur, and Maria Psalla, replacing regular member Grigoris Tsolias, who, although duly summoned in writing, was unable to attend due to a conflict of interest. Also present, by order of the Vice President, without the right to vote, were Georgia Panagopoulou and Ioannis Lykotrafitis, IT specialists, serving as assistant rapporteurs, and Irini Papageorgopoulou, an employee of the Authority’s Administrative Affairs Department , as secretary. The Authority took the following into account: The Hellenic Open University (hereinafter “HOU”) submitted to the Authority, pursuant to Regulation (EU) 2016\u002F679 (General Data Protection Regulation—hereinafter GDPR), the initial notification of a personal data breach, ref. no. Γ\u002FΕΙΣ\u002F8375\u002F31-10-2024, regarding a personal data breach, which was subsequently supplemented by the supplementary notification bearing ref. no. Γ\u002FΕΙΣ\u002F8569\u002F07-11-2024. 1 According to the notification, the incident consists of a breach of the confidentiality and availability of the Hellenic Open University’s personal data, as a result of a malicious external ransomware attack on its information systems. The breach affects approximately 30,000 data subjects, including students, graduates, faculty, administrative staff, and HOU suppliers, whom the HOU states have been notified due to the grave nature of the potential consequences of the incident. Specifically, it is noted that this was done, on the one hand, through an announcement on the main website (www.eap.gr) for the academic community and stakeholders (students, alumni, faculty, administrative staff, suppliers), and, on the other hand, through announcements and email messages for faculty and administrative staff. Copies of the relevant updates\u002Fannouncements are attached to this supplementary notification. Finally, the Hellenic Open University notes that, since this is a ransomware attack by the RansomHub cyber-extortion group, it is necessary to conduct a thorough investigation to fully determine the nature of the breach and the instance in which personal data has been compromised. After reviewing the initial and supplementary notifications, the Authority sent document no. Γ\u002FΕΞΕ\u002F3339\u002F26-11-2024 to the Hellenic Open University, requesting that it to submit, within a reasonable period of time, a new supplementary or complete\u002Ffinal notification clarifying points such as: the nature of the breach and the instanc","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_14\u002F2026&diff=52733&oldid=52728","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-08-19T07:30:45+00:00","2026-08-19T08:00:12.603097+00:00",7,[18,21,24],{"name":19,"type":20},"Hellenic Open University","vendor",{"name":22,"type":23},"unknown","threat_actor",{"name":22,"type":25},"campaign","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[50],{"type":51,"value":43,"context":52},"malware","The data breach resulted from a ransomware attack."]