ATHENS – Hellenic Post (ELTA) – the Greek postal service – was advised a year before a 2022 cyberattack that a check of its computer systems had found it was susceptible to hacks but didn’t have defenses in place to stop it.

The Personal Data Protection Authority (DPA) fined ELTA 2.9 million euros ($2.22 million) in February of 2023 for the lapse that the agency said affected up to five million people and locked down part of the network for days.

The post office was hit despite an internal investigation of its systems showed a high risk of being breached, said Kathimerin, which added that there were security flaws, outdated software in place and inadequate training for workers.

The attack came from the cyber extortionist crew Vice Society which a few weeks after gaining access to personal information posted some of the files on the dark web, although it wasn’t said if a ransom was demanded or paid.

The breach revealed company and employee financial data, board minutes, personal file and customer photos, an OGA pensioners list, responsible declarations and authorizations, customer and supplier data.

In a sample check of the leaked files, the newspaper said that driver’s license photos had apparently been stored on a computer, no report what, if anything, postal authorities had done to protect the system or if anyone was reprimanded.

A 27-page study on the vulnerabilities of ELTA’s electronic systems in 2021 found “more than 80 percent are running outdated, noncompliant supported and vulnerable versions of applications and operating systems, with minor exceptions.”

This condition created the “risk of data interception, data distortion or even data insufficiency,” the investigation found, as well as many users shared common passwords, or in certain instances, simple codes easily broken.

They said that even administrators shared some passwords but it hasn’t been reported what reforms, if any, have been made or if beefed up security has been installed to prevent another cyber attack.