Μake us preferred on Google As brought to light by To Vima, Greece is facing a series of cyberattacks targeting government agencies and private companies, with authorities investigating a major recent breach of the State Legal Council in which hackers stole electronic files and demanded hundreds of thousands of euros in cryptocurrency.
The attack, which took place in early August and was initially kept secret, is considered one of the most serious cyberattacks against a Greek state institution in recent months. Greek authorities are investigating whether it was carried out at the same time as attacks against private companies.
According to information gathered by Greece’s National Cybersecurity Authority and the Hellenic Police, the attackers sent an automated message demanding a ransom in exchange for the return of the stolen files.
The State Legal Council did not agree to pay.
Authorities said the consequences of the attack were minimized because the institution had a complete backup of its databases and was able to recover the stolen files. Greek state agencies also generally refuse to make payments to criminal organizations.
Attacks targeting Greek institutions
The incident is part of a wider series of cyberattacks recorded against Greek public institutions in recent years.
At the beginning of 2025, hackers targeted the “ΣΥΖΕΥΞΙΣ” electronic communications system used by Greece’s public administration. More recently, attacks were reported against the Unified Food Control Agency (EFET) and 27 email accounts belonging to Greece’s General Staff of National Defense.
During the previous two years, cyberattacks also targeted the country’s Land Registry, the Ministry of Education’s database of examination subjects, educational institutions and the National Observatory of Athens. In the latter case, data from payment cards used in the institution’s booking system was reportedly stolen.
A separate attack several days ago targeted the Regional Unit of Rethymno on the island of Crete. Attackers managed to transfer €140,000 from an official bank account belonging to the government service.
Around the same time, the National Organization for the Certification of Qualifications and Vocational Guidance, known as EOPPEP, was also targeted in an attack accompanied by a ransom demand. Some records containing information on teaching personnel are believed to have been lost.
Dozens of attacks have also recently targeted private companies, with attackers reportedly gaining access to transaction data, customer lists and other information.
Ransom demands
In several cases, large sums have been paid either to restore damaged systems or to meet the financial demands of hackers seeking to unlock encrypted or otherwise inaccessible electronic files.
Greek law enforcement authorities have been running an information campaign urging victims not to pay ransoms. According to the information cited in the report, ransoms are paid in around 20% to 50% of such criminal attacks and typically range from €100,000 to €200,000.
Authorities warn that paying does not guarantee that attackers will restore access to the data or resolve the operational problems caused by the breach. They are instead calling on public institutions and businesses to strengthen their cybersecurity systems.
Why the State Legal Council was targeted
The State Legal Council is one of the most important legal institutions of the Greek state. Based in central Athens and employing about 480 people, it represents the Greek government in courts in Greece and before European and international courts.
It also provides legal opinions to the government and public administration and helps resolve disputes between the state and private parties, both through court proceedings and out-of-court settlements.
The council handles arbitration involving the Greek state and represents Greece in important proceedings before the Court of Justice of the European Union, the European Court of Human Rights and other international judicial bodies.
Its work has included major cases involving Siemens, the C4I security system for the Olympic Games, the investment by ‘Ellinikos Chrysos in Skouries’ ( Ελληνικός Χρυσός στις Σκουριές) and Greek efforts to recover antiquities claimed by the state.
The importance of its work contributed to the decision to keep the August cyberattack confidential while authorities investigated it.
Authorities investigate the attack
The Hellenic Police’s Cyber Crime Division is investigating the incident in cooperation with Europol and other foreign authorities. The National Cybersecurity Authority has also been fully informed, while judicial authorities have opened a related case file.
The investigation indicates that the attack on the State Legal Council may have been part of a broader campaign targeting several private businesses at the same time.
Unlike some private victims, however, the council did not yield to the ransom demand. Security officials said the availability of backups significantly reduced the impact of the breach.
In an earlier statement, the State Legal Council said it takes “appropriate technical and organizational measures” to protect personal data stored in both physical and electronic form. These measures include access controls, security locks, electronic access-control systems, firewalls, antivirus systems and data backups.
Crackdowns on ransomware groups
Greek and European law enforcement agencies have recently dismantled several hacker networks, including ransomware groups such as Ragnar Locker, 8Base and LockBit.
Operations including “Kronos,” “Endgame” and “Ransom” have resulted in hundreds of arrests of suspects from Russia, Ukraine, Romania, Poland, Spain, Latvia, the Czech Republic and other countries.
Authorities also seized thousands of servers and bank accounts across several countries in Central Europe. Stolen files were subsequently leaked on the dark web.
Security officials say attacks against public institutions that end with ransom demands are relatively uncommon because state agencies generally refuse to negotiate with criminal groups. However, such attacks can also serve as demonstrations of power, potentially pressuring private companies that have been targeted into paying the demanded ransoms.
Warning over Iran-linked hackers
Greece’s National Cybersecurity Authority also issued a warning several months ago about potential cyberattacks by hacker groups supported by or operating in the name of Iran.
The authority sent an urgent alert to companies and organizations operating in sectors including shipping, energy, transportation and telecommunications, as well as other industries.
The warning came amid growing concern over cyber threats to critical sectors and infrastructure.
