Security notice

Malicious code on elbak.de

Published 4 September 2026

Between August the 30th. and the 4th September 2026, malicious code placed by unauthorised third parties was active on this website. If you visited the site during that period, your device may be affected. Please read the guidance below.

What you should do now Important

Check your device. Run a full scan with an up-to-date security product.
Change your passwords from a different, clean device. Start with your email account, because all other accounts can be reset through it, then online banking, payment services and cloud storage. As long as the affected device has not been cleaned, new passwords will simply be captured again.
End all sessions. Most services offer a “sign out of all devices” option. This renders stolen session cookies worthless; otherwise they work without a password and bypass two-factor authentication.
Set up two-factor authentication again wherever you use it.
Check your statements. Review bank and credit card transactions from the past few weeks and have the card blocked if in doubt.
Move cryptocurrency wallets immediately. Transfer balances to a newly generated wallet with a new seed. A leaked seed cannot be recovered.

What happened

On 1 September 2026 we established that third-party code was being executed on elbak.de. The purpose of the attack was to install so-called infostealer malware on visitors' devices: software that reads stored credentials and other personal data and transmits them to the attackers.

The affected system was taken offline immediately and has been replaced by a separate, independently verified installation. Since 4 September 2026 the website has been running there, free of this code.

Who may be affected

Anyone who opened this website between 1 and 4 September 2026 may be affected. The risk is considerably higher if you followed a fake CAPTCHA prompt, opened your Windows or Mac shell and ran a pasted command by pressing Enter.

Whether the code was already active before that period is currently being checked against the server logs. We will update this notice once that is established.

For visits outside that period, we currently have no indication of any cause for concern.

What data may be affected

We cannot determine which data were actually read from which device. Malware of this type typically accesses:

credentials and passwords stored in the browser
session cookies, which allow sign-in even without a password
stored payment and credit card details
credentials and key files from cryptocurrency wallets
clipboard contents and files in common folders

Because we cannot narrow down the scope, we are informing all visitors from that period as a precaution.

What we have done

taken the affected system offline immediately, stopping delivery to visitors
moved the website to a separate, independently verified installation on different infrastructure
renewed all system credentials and terminated active sessions
preserved the affected system in full for forensic examination
published this notice, because affected visitors cannot be contacted individually

The investigation into how the code was placed on the site is ongoing.

Why we are not contacting you personally

We do not know who visited our website. Page views leave us no information by which individual people could be identified or contacted, and the site operates no user accounts. Individual notification is therefore not possible; under Art. 34(3)(c) GDPR this public notice takes its place.

Questions about this incident? Write to us at peach@elbak.gr. For data protection matters, please contact our Data Protection Officer, Soula Triantafillou, at soula.triantafillou@elbak.gr.

SINCE 1972 WE DELIVER GREECE SUN-RIPENED FRUITS WORLDWIDE

Located in the heart of Greece, Elbak S. A. is one of the predominant producers of preserved fruit in the country. Retail chains from over 70 countries appreciate the consistently high quality of our products. From sowing and harvesting to preservation and distribution, we at Elbak supervise the entire production process. This allows us to deliver premium-quality, delicious fruit straight from the sun-kissed orchards of Greece to the rest of the world.

HAND PICKED & PROCESSED IN LESS THAN 24 HOURS

BEST QUALITY
SINCE 1972

IN HARMONY WITH NATURE

RECYCLABLE CANS

HAND PICKED & PROCESSED IN LESS THAN 24 HOURS

BEST QUALITY
SINCE 1972

IN HARMONY WITH NATURE

RECYCLABLE CANS

MODERN PRODUCTION FACILITIES, FINELY TUNED WORK PROCESSES AND OUR SHEER PASSION ENSURE RESULTS THAT ARE WORTH ENJOYING.

Farmers in association

Years of experience

Tonnes per year

Hours from harvest to processing

Working in close collaboration with producers. A wealth of experience High yields of premium quality fruit every year Immediate transfer from harvesting to processing.