Greece faces EU fines as Mitsotakis struggles with cybersecurity delays
Greek Prime Minister Kyriakos Mitsotakis faces mounting pressure over cybersecurity vulnerabilities as the EU’s strict new cyber resilience rules loom, while experts warn Greece’s digital infrastructure remains dangerously exposed.
Greece’s government has yet to implement a national cybersecurity strategy aligned with the EU’s Cyber Resilience Act (CRA), which mandates strict security standards for digital products and services by the end of 2027, according to a critical analysis by Cambridge University researcher Makó Gerald . The delay leaves Greece—alongside Hungary—among the most vulnerable EU members to large-scale cyberattacks, Gerald argues, citing the country’s lack of investment in defensive infrastructure and overreliance on private-sector contracts, such as Hungary’s controversial 1.3 trillion HUF (€3.3 billion) deal with 4iG, which critics call opaque and insufficient.
The EU’s 26th Cybersecurity Directive (NIS2), which Greece is legally bound to transpose into national law by October 2024, requires member states to establish Computer Security Incident Response Teams (CSIRTs) and enforce mandatory reporting for critical infrastructure operators. Yet Greece’s National Cybersecurity Authority (NCA) has faced repeated delays in operationalizing these measures, with officials citing bureaucratic hurdles and underfunding . The country’s digital resilience score, tracked by the EU’s Cybersecurity Competence Centre, ranks 22nd out of 27 member states, below even Hungary.
Mitsotakis’s government has instead prioritized foreign investment in high-tech sectors, unveiling a fast-track framework this week to attract €50 million+ projects in AI, cloud computing, and critical infrastructure . However, experts warn that without robust cybersecurity safeguards, such investments could become liabilities—particularly as state-linked hacking groups, like Iran’s Ababil of Minab (blamed for a recent crippling attack on Los Angeles’ transit system), escalate targeting of transport, energy, and financial networks .
Adding to the urgency, 25 digital rights organizations this week condemned Greece’s proposed social media ban for minors, arguing it could undermine encryption and anonymity tools—key defenses against surveillance and cyber threats . The letter to Mitsotakis highlights a broader tension: balancing digital rights with security, a challenge Greece has yet to resolve as the 2027 CRA deadline approaches.
With no public timeline for Greece’s compliance with NIS2 or the CRA, officials have offered only vague assurances. A spokesperson for the **Ministry of Digital Governance** told *HVG* that a "national cybersecurity strategy" is in development, but declined to specify milestones or funding. Meanwhile, the European Commission has begun pre-infringement proceedings against Greece for failing to transpose NIS2, a step that could lead to fines of up to 2% of GDP if unresolved.



