Under attack?
The first hour, step by step.
- Disconnect the affected computers from the network. Leave them switched on.
- From a clean device, change the administrator, email and remote access passwords.
- Keep the evidence: screenshots, the ransom note, logs and times. Wipe nothing.
- Call your IT provider and the people who decide.
- Do not reply to the attacker or pay before you have advice.
Report it
Essential and important entities under Law 5160/2024: an early warning within 24 hours of becoming aware, a notification within 72 hours, a final report within a month (Article 16)[1].
- The CSIRT of Greece's National Cybersecurity Authority (ΕΑΚ): the 24-hour form from the ΕΑΚ's page, to incident@cyber.gov.gr. Central government and local authorities: to the ΕΥΠ's CSIRT, copying the ΕΑΚ[2].
- Police Cybercrime Division: 11188 (free) or ccu@cybercrimeunit.gov.gr[3].
A customer? Open an incident in the console: it starts the clocks and drafts the reports.
The contacts were checked on the authorities' own pages on 28 October 2026.