Not long ago, a very good colleague told me: “Watch this series. It’s called Years and Years.” When I asked the audience at Acronis Day Athens 2026 whether anyone had seen it, nobody had. Neither had I.
The series shows something simple and terrifying: the small changes we accept every day can, year after year, lead us to a future none of us would want. And as I watched it, I kept thinking of one thing: this is exactly what we see every week in the cybersecurity of Greek businesses.
Acronis Day Athens 2026 took place on 11 March 2026 at the Baraonda Music Hall in Athens. It is the annual executive event of Tictac Cyber Security on cybersecurity, risk management and business resilience, aimed at CEOs, CISOs, CFOs and IT Directors. My slot was the Threat Landscape 2026. In this article I walk you through the talk, with real incidents, because those are what stick. (The talk itself is in Greek.)
How did we get here? One small compromise at a time
Let’s be honest. You don’t need to raise your hand. Many of us have, or had, cracked software in the office, in the business, at home. “Who pays for licences in Greece anyway?”
Then we bought a firewall. We paid 2,000 to 5,000 euros. And when the time came to pay for updates, roughly 30% of its value every year, how do you tell the boss? So the firewalls stayed without updates.
Then we opened “a port or two” on the firewall, because the external partner needed access. One became seven. And through every open, unprotected port, someone can walk into your infrastructure completely undisturbed.
The list goes on:
- We didn’t upgrade from Windows 10, because it needed both money and new hardware. So we are running an operating system that no longer receives updates, while new vulnerabilities appear every day.
- We didn’t put the backup in the cloud, because “the cloud is just someone else’s PC”.
- We didn’t move email to Microsoft or Google, because 100 mailboxes at 5 euros a month “is money”.
- We didn’t train our people, because “the IT Administrator does that”. The same IT Administrator who has spent twenty years telling Maria not to click on suspicious emails and Tasos not to stick his password on a sticky note on the screen.
None of these decisions looks tragic on its own. Together, they are exactly what the series is about.
Why did a €5,000 ransomware attack cost €100,000?
A company of 50–60 people. Small, but working on projects for very large companies abroad. It is hit by ransomware and the attacker asks for just €5,000, because he didn’t even know what he had hit.
The owner said the logical thing: “It’s only 5,000, pay it and let’s be done.”
But the decryptor didn’t work the first time. The large clients abroad started to get suspicious. They sent their own auditors with a simple message: “We trusted you. You told us you had backups, updates, patching.” They made him pay €20,000 for a penetration test by their own consultant. The consultant found huge gaps. And a huge budget followed to close them.
The result: a ransomware attack that cost €5,000 led to roughly €100,000 in collateral losses. And today the business is on the edge.
The ransom is rarely the big cost. The big cost is the trust you lose.
Business Email Compromise: the €120,000 that never arrived
A second case. A Greek services company takes on a €1 million project for a company in London. The first payments go through normally. By the third one, the €120,000 that closes the project, a hacker is already inside the email conversation. He changes the bank account and takes the money.
This is called Business Email Compromise (BEC). And very often it relies on things that sound boring: SPF, DKIM, DMARC, the settings that tell the world who is allowed to send email on your behalf. If they are not set correctly, someone else can “become” you.
So who is to blame? Tasos?
I’ll tell you something not everyone likes to hear. When management doesn’t know, the responsibility lies with the IT person. The boss always says: “I have Tasos here for everything.”
If Tasos is afraid to say “this costs X and it has to be done”, and doesn’t put it in writing to cover himself, at the critical moment he will hear: “Why did you never tell me?”
The role of the IT Administrator is not to know everything. That’s impossible. Their role is to be management’s trusted advisor for the right decisions and the right external partners.
And if you are a CFO or a CEO: you are the one who feels the final pain if something goes wrong. It’s not a bad thing to say “Tasos, let’s bring in a second pair of eyes”. In a risk assessment, Tasos knows of five risks. When he sits next to a senior engineer who has seen hundreds of incidents, they will find twenty-five. That doesn’t mean you will fix them all. It means you know about them, you and your management.
One more thing: do you have a Business Continuity Plan (BCP), a plan for how the business survives an attack? Has anyone ever tested it in practice?
€600,000 in ransom, and a backup that “couldn’t be touched”
Attacks in Greece lately are more targeted: businesses with €3–4 million in turnover and above. And the amounts will shock you. In the last two months alone we saw demands of €600,000 and €800,000.
In a recent incident, the owner had all his backups on two NAS devices, and an external disk on top of each NAS. Double, triple, quadruple backup. The hacker wiped them all.
The CFO told us: “They set up a storage system for me and told me it was immutable, that nobody could touch it. I’m a CFO, how would I know?” That is exactly why you need a second pair of eyes.
There is some good news in this story too. Recovering data after ransomware is usually not possible, because of the encryption. But we have found a few loopholes that work in roughly 10–15% of cases. In this one, after about 15 days in the lab, we had recovered around 65% of the data, without paying the €600,000. It is rare. But we always check.
When the hacker makes a mistake too
Sometimes even the attackers don’t know what they are hitting. A hotel in Athens is attacked and the hacker asks for €7,200,000. Why? “You have a turnover of 500 million.” But we are a small hotel. “Aren’t you a chain?”
We laugh, but it shows something important: attackers work at scale and automatically. They don’t pick you because you are important. They find you because you are exposed.
The two big threats we haven’t solved yet
1. Calendar invites. Has a meeting you never accepted ever appeared on its own in your calendar? One click on the link is enough. One like that landed in my personal email a few days before the talk. Without email filtering they are hard to block. Google now lets you accept invites only from your contacts. Microsoft, at the time of the talk, was still discussing it. The more advanced email security solutions stop these messages, because they usually come from domains created 3–5 days earlier.
2. Infostealers, the biggest plague of the year. An infostealer is malware that steals passwords and cookies. It starts from a Chrome extension or from a command that you are tricked into running yourself.
The Thursday before the talk, a friend from a hotel we look after called me. A page that looked like booking.com was asking her, “to prove she’s not a robot”, to press Windows + R, then Ctrl + V, then Enter. What does that do? It opens the Windows Run box and pastes a command the page had already put on the clipboard. You only see a harmless “I am not a robot – Booking verification ID”. Behind it, Windows’ mshta runs an obfuscated URL that talks to the attacker’s server.
The command writes nothing to disk, it runs in memory. So which antivirus is going to catch it?
And here’s the worst part. The infostealer doesn’t just take passwords. It also takes your active cookies. You’ve just logged into your bank, and a cookie says “Mr Mingos is logged in for the next few minutes”. The hacker loads it into a browser and gets in without a username, password or MFA. This data is sold ready-made on dark web markets such as Russian Market, by country and by day: “I’ve got Mr So-and-so from Greece today”.
What do you do?
- Remove local admin rights from every machine.
- Restrict PowerShell and mshta for users who don’t need them.
- Put URL filtering in place.
- And train your people: no legitimate website will ever ask you to press Windows + R.
Deepfakes and AI agents: the next chapter
Recently we were asked to join a video call for a major deal, around half a million euros, for one reason only: to confirm that the person on the other side was real. Yes, we built a process and a service for that. When the stakes are that high, deepfakes are no longer theory.
And then there are AI agents. This isn’t ChatGPT answering questions. It’s software that acts: it writes files on your computer, searches the internet, logs into systems. To test it, I asked an agent to publish, on its own, an article on my blog about how it wrote that article. I only gave it the admin page. An hour and ten minutes later, at a cost of about €6, the post was ready (in Greek). It is incredibly powerful. And whatever it can do for me, it can do for an attacker.
The “7 deadly sins”, straight from the hacker
I closed with something worth as much as the whole talk. A note sent to us by the hacker himself, after he had hit a business and been paid very well. At the end, as a “gift”, he wrote how to avoid it happening again. Take a photo if you like.
- We got in through the dark web. We bought the credentials of one of your employees (let’s call him Tasos).
- Nobody should click on suspicious emails.
- Strong passwords, changed often, and 2FA wherever possible.
- Latest operating system versions. No Windows 7, no Windows 10.
- Antivirus and traffic monitoring. “I was inside for 15–20 days with a connection to a malicious IP and nobody noticed.”
- A jump host for the VPN.
- Backup with cloud storage and a token key, meaning MFA is needed to open it.
Local backup alone is no longer enough. Yes, it’s the fast option. But critical systems must also live in the cloud, behind a secure dashboard with MFA and encryption, where the hacker can’t reach them.
If you want more, I’ve also written about the 7 deadly sins of cybersecurity.
What do I do now?
My last slide read: Years and years of small mistakes lead to a different insecure world. That is today’s reality. And here are five things you can do starting tomorrow:
- Write down your “small compromises”. Firewall without updates, open ports, Windows 10, backup only on site. The list is already half a risk assessment.
- Check SPF, DKIM and DMARC on your domain.
- Remove admin rights from users and restrict PowerShell and mshta.
- Keep one copy of your backup off the network, in the cloud, with MFA.
- Bring in a second pair of eyes. Not to judge Tasos, but to work with him.
You don’t need to be a big company to become a target. It’s enough to have collected enough small shortcuts.
And if your stomach can take it, watch Years and Years. It’s only six episodes. You’ll remember me.
Did you like this article? Share it with someone who needs to read it. Your comments are always welcome!