“Hacked by…” instead of government services: the attack on ΕΦΕΤ showed the vulnerability of old sites

Website hacking Greek Unified Food Control Authority ΕΦΕΤ became another reminder: old and poorly updated sites remain a convenient target for automated attacks.

On some pages of the efet.gr portal, the inscription “Hacked by Trenggalek6etar” appeared, characteristic of the so-called defacement, when attackers gain access to the site and replace its content. At the time of inspection, some sections of the resource continued to open normally, and some pages displayed a message about hacking. Checking the English version of the ΕΦΕΤ website confirmed the presence of a deface.

ΕΦΕΤ, or the Unified Food Control Authority of Greece, is responsible for food safety supervision, plant inspections, recalls of dangerous products and consumer information. Therefore, even an external substitution of the main page does not look like a harmless prank: a government resource must remain reliable, especially when warnings, product reviews and messages for citizens are published through it. Official section for consumers ΕΦΕΤ indicates that the website contains information related to food safety.

What happened on the site

“Hacked by Trenggalek6etar” is not the name of a known international cyber group with a public structure or a proven political agenda. Most likely, this is an alias or signature of the attacker left after gaining access to the web resource.

Such a defacement in itself does not prove the theft of databases, hacking of internal services or leakage of personal data. However, it proves the main thing: the attacker was able to change at least part of the site’s content. To establish the scale of the incident, it is necessary to check server logs, analyze downloaded files, administrator accounts, backups and possible traces of intrusion.

There was no official statement from ΕΦΕΤ about the method of hacking or whether internal systems were affected at the time of publication. Therefore, it would be premature to say that a specific old version of Joomla was the cause. But the situation itself shows a well-known problem: sites with outdated CMS and forgotten extensions often become the target of mass scanning.

Why old Joomlas are especially vulnerable

Joomla itself is not inherently leaky. But any CMS that hasn’t been updated for years is gradually turning into an open door. Joomla developers regularly release patches for critical and moderate vulnerabilities, including access control errors, multi-factor authentication bypass, and user rights enhancements. In May 2026, Joomla released another series of security patches for versions 4, 5 and 6. Joomla Security Center

Not only the CMS core, but also third-party extensions pose a particular risk. In June 2026, the Belgian Cyber ​​Security Center warned of a critical vulnerability in the popular Joomla Content Editor extension, which, under certain conditions, could allow an unauthorized user to upload an arbitrary file to the server. CCB Belgium warning

For the site owner, this means a rather unpleasant thing: the resource may look neat and work for years, but at the same time contain an old component, plugin or module that has long been known to automatic bots. These bots do not select victims manually. They simply scan the Internet, look for vulnerable versions, try standard paths and, if they gain access, leave their digital autograph.

The number of attacks is growing, but there are few accurate Greek statistics

It is still difficult to talk about the sharp increase in attacks on websites in Greece as a strictly proven statistical trend: open data on defacements, CMS hacks and attacks on small websites is collected in fragments. But the overall picture in Europe and the region is alarming.

In March 2026, Greece’s National Cyber ​​Security Authority recommended that companies in critical industries check their systems following an increase in threats related to regional tensions and the activity of hacker groups. As reported Reuterscompanies from the shipping, banking, transport, telecommunications, healthcare and energy sectors received warnings.

At the European level, Black Kite researchers recorded a 55.1% increase in the number of publicly disclosed ransomware attacks in the first four months of 2026 compared to the same period a year earlier. This does not mean that all such incidents are related to Joomla or site defacements, but it shows the general background: cyber threats are growing, and small organizations and older web projects are often less protected than larger systems. Report on the growth of attacks in Europe

What site owners should check

After such cases, owners of Joomla sites should not wait until the next “Hacked by…” appears on the main page. The minimum set of actions looks boring, but boredom in cybersecurity is usually cheaper than restoring a site after a hack.

It is necessary to update the Joomla core, extensions and PHP; remove unused plugins; change passwords for hosting, control panel, FTP/SFTP, database and administrative accounts; enable two-factor authentication; check unknown accounts, cron tasks, files in templates and download folders. It is especially important to save logs and copies of infected files before cleaning: otherwise, you can quickly restore the appearance of the site, but not understand through which door the attacker entered.

The National Cyber ​​Security Service of Greece reminds that significant incidents can be referred to the competent authorities, and organizations should build not a one-time “clean-up after a hack”, but an ongoing system of updates, backups and access control. National Cyber ​​Security Authority of Greece

The story of ΕΦΕΤ is important not because of one inscription on the site. It shows that outdated digital infrastructure remains a weak point even for organizations associated with government functions. In 2026, a website without updates is no longer “old, but working.” He often simply has not yet managed to get on the list of targets of the next bot.

Sources: ΕΦΕΤ, Joomla Security Center, CCB Belgium, National Cyber ​​Security Authority of Greece, Reuters.

Source link