Administrator of EAK Michalis Bletsas: "The sharing of telephone numbers and personal emails in every way automatically erases all kinds of privacy on the internet. Information that is not substantive is published as is."

Reporting by Greece National Cybersecurity Authority AlertsRead the original at cyber.gov.gr

Executive Summary

Dissemination of telephone numbers and personal emails inherently violates online privacy. Reports indicated that Greek officials, including the Director of the EAK, and journalists received messages from an Italian number on WhatsApp containing leaked personal data regarding senior government officials. Screenshots from a supposed information collection application were shared with the Director of the Authority, concerning the Prime Minister and the President of Cyprus, including email addresses and telephone numbers. The mobile number associated with the Prime Minister was old and publicly accessible since 2018. For the Director of the EAK, some numbers belonged to associates or public registrations from over twenty-five years ago, and the email address was secondary. The evidence suggested the material resulted from a collection of old, publicly available data rather than a system breach or malicious access. The text asserts that sharing contact information on the internet negates privacy rights, noting that commercial exploitation is governed by GDPR and falls under the Data Protection Authority's jurisdiction.

Facts Only

* On September 7, 2026, Greek officials and journalists received messages from an Italian telephone number on WhatsApp concerning personal data leaks about senior government officials.
* Three screenshots from a supposed information collection application were shared with the Director of the EAK.
* The leaked information concerned the Prime Minister and the President of the Republic of Cyprus.
* The mobile number associated with the Prime Minister was old and publicly accessible since 2018.
* Some telephone numbers shared with the Director of the EAK belonged to associates or were from public online naming registrations made 25 years or more ago.
* The material is described as a collection of old, publicly available, or voluntarily shared information from data broker platforms.
* The events did not result from a system breach or malicious access to state infrastructure.
* The legality of commercial exploitation of personal data is governed by the General Data Protection Regulation (GDPR).

Full Take

The narrative shifts the focus from an acute security failure—a system hack—to the systemic reality that personal contact information is inherently exposed through public systems and data brokerage. The core implication is that the vulnerability lies not in secure infrastructure but in the voluntary, often casual, circulation of metadata across the internet. This recontextualizes cyber threats away from technical exploits toward social engineering, where identity data serves as a key for manipulation. The recommendations presented outline a necessary structural shift: separating identities and mandating physical authentication methods like FIDO2 over easily compromised channels like SMS. The call for institutional responsibility underscores that privacy is not merely a legal framework but a tangible condition of agency. The system seems designed to generate panic about a specific incident when the true, more insidious problem—the perpetual leakage of identity data—is more profound. This suggests an ongoing tension between reactive security measures and proactive regulation regarding data ownership and public exposure.

BRIDGE QUESTIONS: If the focus is on structural data brokerage rather than system breaches, how can institutions effectively mandate responsibility for data storage versus controlling data flow? What specific mechanisms are needed to enforce the separation of identities described in the recommendations across disparate commercial platforms? How does a society move from viewing personal identifiers as mere entry points for social engineering to treating them as non-transferable assets?

From the original · Greece National Cybersecurity Authority Alerts

Director of the EAK Michalis Bletsas: "The dissemination of telephone numbers and personal emails in any way automatically violates all types of online privacy. Unsubstantiated publications deal with the obvious."

Read the full story at cyber.gov.gr

Sentinel — Human

Confidence

The text appears to be a detailed analysis synthesizing a specific event with broader concerns about data privacy and security practices, exhibiting the structured reasoning of human policy or investigative writing.

Signals Detected

Moderate sentence length variance and complex, layered argumentation typical of policy writing.

Strong internal logical flow connecting specific anecdote to broad systemic implications (data brokers, social engineering), suggesting a human analytical structure.

The argument moves from specific incident details to generalized policy recommendations in a structured manner, avoiding verbatim matching of external sources.

The core narrative relies on citing an official body (EAK) and framing data broker concerns rather than presenting raw, unverified claims, typical of journalistic synthesis.

Human Indicators

Use of specific organizational references (EAK, GDPR context) and a transition from specific reporting to high-level policy recommendations is characteristic of official or deep journalistic analysis.

The nuanced distinction between the immediate incident and the broader threat (phishing, doxxing) suggests an analytical synthesis rather than simple reportage.