Diaspora Cybersecurity Risks and How to Reduce Them

Diaspora communities face two kinds of online danger at once: ordinary crime such as phishing and fraud, and targeted pressure from foreign governments that want to monitor, silence or influence them. The defenses are mostly the same for both. Protect accounts with phishing-resistant authentication, keep devices updated, limit who can access what, train people to spot manipulation, and write down an incident plan before you need it. This guide explains who is targeted, how the attacks work, and what a small association, cultural center or individual activist can realistically do.

Hellenismwatch

Understand Risks Facing Greek Diaspora

Hellenism Observatory monitors threats and opportunities affecting the Greek diaspora across the Balkans and Eastern Mediterranean, using credible sources.

Visit Hellenism Observatory

TL;DR

Diaspora groups are exposed to phishing, spyware, impersonation, doxxing and harassment, often with little in-house technical capacity.
Governments may target diasporas to protect their power at home, shape opinion abroad or silence critics, and they sometimes pressure relatives overseas.
The most useful steps are cheap: phishing-resistant multifactor authentication, updates, removing unused accounts, least-privilege access and staff training.
Write and rehearse an incident plan that names who to contact, and protect the people affected before the system.
Awareness campaigns work better when they are designed with the community, not aimed at it.

Why diaspora communities are targeted
The most common threats
Digital security for activists and outspoken members
The community weak points nobody likes to discuss
Practical steps for organizations
Responding to a suspected incident
Perspective: what we see at Hellenism Watch
Where to follow this work
FAQ
Sources

Why diaspora communities are targeted

A diaspora is a network: people, families, clubs, churches, cultural centers, media and fundraising, spread across borders and tied together by messaging apps and social media. That makes it valuable to two groups of attackers.

The first is criminals, who go where trust is high and defenses are thin. The second is states. A joint guide from US authorities explains that foreign governments may interfere to protect stability at home, retain or increase power, influence opinion abroad, and silence critical voices. A diaspora can also give such a government a potentially large voice inside a host-country society, which is another reason to try to steer it.

The same guide notes that, according to industry reporting it cites, state-sponsored targeting of high-risk communities, including diaspora organizations, predominantly comes from the governments of Russia, China, Iran and North Korea. That is a statement about the documented pattern of state-sponsored targeting, not a claim that every community faces every one of these actors. Your own exposure depends on what your group says, whom it criticizes and which countries have an interest in it.

The Dutch security services reach a similar conclusion. The NCTV and AIVD describe how foreign governments may target diaspora members to protect stability in their own countries or to retain and increase their own power.

Pressure that starts offline and ends online

The digital attack is often one part of a wider campaign. Australia’s government describes how foreign interference in diaspora communities can involve threatening family or associates overseas to force individuals to advance the interests of a foreign government. A threatening message to a relative, a sudden visa problem or a warning that “we know where you live” can arrive alongside a hacked account or a leaked address.

Canada’s public safety department adds that transnational repression disproportionately affects members of diaspora groups working to protect political, human, religious and minority rights in their home countries. If your community organizes on those issues, assume that your digital footprint is of interest to someone.

The most common threats

The CISA-led guidance for civil society lists the recurring risks: phishing and social engineering to steal credentials, malware and spyware for surveillance, and other attacks that exploit low defense capacity and insecure communication channels. In practice they look like this.

Phishing and account takeover

A board member receives a message that looks like a shared document from a fellow volunteer. The link leads to a fake login page. Once the attacker holds the password, they read the mailbox, impersonate the president to ask for a “quick transfer” or collect the member list. Because diaspora organizations run on goodwill and informal trust, such requests rarely get a second look.

Spyware and malware on personal devices

For the highest-risk people, the target is the phone. The same US guidance warns that personal devices and accounts are frequent targets for state-sponsored spyware, so individuals should protect them just as an organization protects its systems. Volunteers who run the group’s social media from a personal phone have effectively made that phone part of the organization’s attack surface.

Insecure networks and shared devices

Research on small-scale migrant traders found that they often use mobile devices connected to insecure networks for business, which raises the risk of unauthorized access and eavesdropping. The setting is commercial, not political, but the habit is familiar in community life: public Wi-Fi at an event, one tablet shared by several volunteers, a group chat with no one tracking who is in it.

Fraud at scale

Crime is a larger daily threat than espionage for most families. DNS Belgium reports that 49 million euros were stolen through phishing in Belgium within a single year, plus 14.6 million euros through investment fraud. It also cites more than 442 billion dollars lost to online fraud worldwide over 12 months. These are figures from one registry’s reporting and cover the whole population, not diaspora members alone, but they show the scale of the criminal market that diaspora communities share with everyone else.

AI-written lures

The old advice to look for bad spelling is losing value. A 2026 session by DNS Belgium and IOM highlighted that cybercriminals increasingly use generative AI to create convincing messages and websites, which makes fraud harder to detect. The GSMA similarly notes that organized criminals now use AI to carry out social engineering at scale and to refine their tactics for different populations in different regions. For a community that uses several languages, a fluent message in the right language is no longer proof of a real sender.

Digital security for activists and outspoken members

People who speak publicly face a sharper version of these risks. The Center for Long-Term Cybersecurity at UC Berkeley lists the tools of digital transnational repression: targeted spyware, malware, harassment, disinformation campaigns, DDoS attacks, doxxing, impersonation and phishing. Its research finds that these attacks, often gendered or identity-based, aim to intimidate and discredit. The consequences are human: self-censorship, fear for family safety and social isolation, which in the end hinders advocacy.

Marcus Michaelsen’s academic work makes a related point. The complexity of digital tools and the constant change in risks increase activists’ uncertainty and create a silencing effect, which is why he calls for better incident response networks. Fear of being watched can do part of the attacker’s job even when no breach occurs.

For an activist, the practical consequences are these:

Separate roles. Use distinct accounts and, where possible, distinct devices for public advocacy, private life and organizational finances.
Assume impersonation. Agree in advance on a second channel to verify any urgent or unusual request, especially one that claims to come from a colleague.
Limit what can be doxxed. Review what your public profiles reveal about your home, workplace and relatives, and who else can see the group’s member list.
Know whom to call. Identify a trusted digital security helper or reporting channel before an incident, not during one.

The community weak points nobody likes to discuss

Technology is only part of the picture. The NCTV and AIVD observe that internal diaspora tensions, caused by political disputes tied to the country of origin, can foster environments where members gather information on one another for a foreign government. Open feuds, rival factions and suspicion between members are opportunities for an outside party.

That has a governance consequence. Membership lists, event registrations and private chats should be handled on a need-to-know basis. It also argues against witch hunts: treating every disagreement as infiltration damages a community faster than most attackers could.

There is also a communication problem. DNS Belgium argues that conventional awareness campaigns often fail to reach diaspora communities because they are not designed inclusively and can carry stigmatizing messages. Safety advice that comes across as blame will be ignored. Advice that arrives in the community’s languages, through its own trusted voices, and that treats members as capable adults has a better chance.

Practical steps for organizations

The following steps draw on the joint CISA-led guidance for civil society organizations with limited resources. None needs a large budget.

Turn on phishing-resistant multifactor authentication. Start with email, the domain registrar, social media and banking. Hardware security keys and passkeys resist fake login pages better than codes sent by text message.
Keep all software updated. That means phones, laptops, the website and any plug-ins. Switch on automatic updates and retire devices that no longer receive them.
Audit and remove unused accounts. Former volunteers, old event tools and forgotten mailing-list logins are doors left unlocked.
Apply least privilege. Give each person only the access their role needs. The newsletter editor does not need the bank login, and a new volunteer does not need the member database.
Train people on social engineering. Use real examples, including AI-written ones, and make reporting a suspicious message a normal and blame-free act.
Vet vendors. Check who hosts your site, runs your mailing list and manages your donations or ticketing, and what happens to your data if they are breached.
Protect personal devices and accounts. The people running the group’s accounts are the target, so secure their phones and private email too.
Write and rehearse an incident plan. More on this below.

A small cultural center can do the first four in a weekend. The last four become habits over a year.

Responding to a suspected incident

The guidance advises that organizations develop and exercise an incident response and recovery plan that covers critical systems and lists who to contact or report incidents to for assistance. A one-page version is enough to start:

Who decides. Name one lead and one deputy, with phone numbers that do not depend on the compromised system.
What to do first. Change passwords and revoke sessions from a clean device, disconnect the affected device, and preserve screenshots and messages as evidence.
Whom to protect. Ask which people could be harmed if member data, private messages or addresses leaked, and warn them early. In cases of pressure on relatives abroad, the person’s safety comes before the recovery of the account.
Whom to call. List your national cybersecurity agency or police reporting line, your bank, your platform contacts and an independent digital security helper.
How to rehearse. Run a 30-minute walk-through once a year, and update the plan when roles change.

Perspective: what we see at Hellenism Watch

We monitor the state, threats and opportunities of Hellenism across the Balkans and the Eastern Mediterranean, and we see cyber risk as part of that wider picture rather than a separate technical topic. For diaspora institutions, the weak point is seldom a lack of intelligence. It is a lack of time, money and shared routines. Communities that depend on volunteers and personal phones are exposed in ways that no one in the organization intended.

We also believe that claims about foreign influence must be documented. A community that accuses without evidence loses credibility and gives attackers another weapon. That is why we insist on independence from governments and parties, and on tying every assertion to a source a reader can check. The same discipline helps in security: verify before you act, and write down what you know and how you know it.

Finally, no single institution holds all the expertise. Technologists, area scholars, lawyers and community leaders each see a different part of the problem. The most useful defense is a network that shares what it learns openly.

— Alexios

Where to follow this work

Hellenism Watch is an independent, non-profit initiative that publishes free, source-backed research on the Greek diaspora, foreign influence and diaspora institutions. You can read our work on the Hellenism Watch site. Scholars and analysts who want to contribute data or expertise can see how to take part through our fellows page.

FAQ

What are the most common cybersecurity risks for diaspora groups?

Phishing and social engineering to steal credentials come first, followed by malware and spyware used for surveillance. Attackers rely on the fact that many community organizations have little defense capacity and use insecure channels. Fraud and impersonation of trusted members are the most frequent day-to-day problems.

Why would a foreign government target a diaspora community?

Governments may want to protect stability at home, hold on to or increase their power, influence opinion abroad or silence critics. A diaspora can give them a voice inside the host society. Some also pressure relatives who live in the country of origin to force a person to act.

How can activists protect themselves online?

Secure accounts with phishing-resistant authentication, keep devices updated and separate personal, public and organizational accounts. Verify unusual requests through a second channel and limit the personal details visible online. Identify a trusted digital security helper before you need one.

What should an organization do after a suspected breach?

Follow the incident plan: act from a clean device, change credentials, preserve evidence and contact the people named in the plan. Then warn anyone whose data or safety may be affected, and report the incident to the relevant authority. If you have no plan yet, write a one-page version now.

Is AI making these attacks worse?

Yes, in the sense that it makes lures more convincing. Reports from DNS Belgium with IOM and from the GSMA both describe criminals using generative AI to write persuasive messages and sites at scale. Good spelling is no longer a sign of a genuine message, so verify the sender rather than the style.

Diaspora Cybersecurity Risks and How to Reduce Them