The danger bell is ringing for EAK: When the access code becomes the gateway for the malicious.

* Corporate and service credentials are protected from theft and malicious use.
* Credentials circulate in illegal online markets originating from infostealers, phishing attacks, and password reuse from breached third-party services.
* The use of stolen credentials allows access to correspondence, documents, and personal data.
* Protection of credentials is a legal obligation under Law 5160/2024 and Presidential Decree 1689/2025.
* The Authority requested public sector bodies implement multi-factor authentication (MFA) and address vulnerabilities via circulars of June 8th and July 30th, 2026.
* Recommendations include using unique, strong passwords per service stored in password managers.
* Recommendations include enabling MFA via authenticator apps or security keys.
* Recommendations include installing software only from trusted sources and avoiding storage on personal/shared devices.
* IT departments must systematically monitor for leaks, change exposed passwords, terminate sessions, disable old protocols, and implement updates promptly.
* Suspicious access should be reported to incident@cyber.gov.gr or the Hellenic Police Directorate for Cybercrime Investigation (tel. 11188).

The narrative establishes a clear pivot from a technical problem—credential theft—to a legal and operational imperative regarding personal and organizational security. The core tension lies between the decentralized, often opportunistic nature of credential leakage on illegal markets versus the centralized, mandatory responsibility placed upon entities to secure these assets. The system frames protection as both a technical mandate (MFA, strong passwords) and a legal obligation, suggesting that failure stems from neglect rather than inability.
The pattern observed is one of systemic friction: external threats exploit known weaknesses (infostealers), which then trigger internal compliance failures in security protocols. The emphasis on mandated actions (MFA implementation for public bodies) contrasted with the individual responsibility (password management) highlights a gap between regulatory enforcement and actual, consistent operationalizing. This structure channels the reader's focus toward self-regulation as a necessary, yet often insufficient, layer of defense against sophisticated threats that operate outside conventional administrative boundaries. The implication is that cognitive sovereignty requires shifting from reacting to external attacks to enforcing internal, resilient systems where procedural adherence is automatic rather than optional.
Bridge questions: If legal obligations are established but compliance remains sporadic across entities, what structural mechanisms could ensure accountability beyond mere reporting? How does the perceived inevitability of data leakage influence the willingness of organizations to invest in preventative controls over reactive remediation? What is the relationship between individual cognitive sovereignty and institutional security infrastructure?