Health Service Executive ransomware attack: Difference between revisions

Health Service Executive ransomware attack
Date	14 May 2021
Location	Ireland
Type	Cyberattack, data breach, ransomware using Conti
Target	Health Service Executive (HSE); Department of Health;
Outcome	All HSE IT systems shutdown; Hospital disruptions and appointment cancellations; Department of Health IT systems shutdown; Medical data breach; Employee record data breach;
Suspects	Wizard Spider, ContiLocker Team

Browse history interactively

← Previous edit

Content deleted Content added

VisualWikitext

Inline

Latest revision as of 08:58, 18 July 2024

On 14 May 2021, the Health Service Executive (HSE) of Ireland suffered a major ransomware cyberattack which caused all of its IT systems nationwide to be shut down.^[1]^[2]^[3]^[4]

It was the most significant cybercrime attack on an Irish state agency and the largest known attack against a health service computer system.^[5]^[6] Bloomberg News reported that the attackers used the Conti ransomware.^[7] The group responsible was identified as a criminal gang known as Wizard Spider, believed to be operating from Russia.^[8]^[9]^[10] The same group is believed to have attacked the Department of Health with a similar cyberattack.

On 19 May, the Financial Times reviewed private data for twelve individuals which had appeared online as a result of the breach.^[11] On 28 May, the HSE confirmed confidential medical information for 520 patients, as well as corporate documents were published online.^[12]

Background

The attackers began by sending a malicious email to a workstation on 16 March 2021.^[13] The email was opened on 18 March.^[13] A malicious Microsoft Excel file was downloaded, which allowed the attackers access to HSE systems.^[13] The attackers gained more access over the following weeks.^[13] The HSE antivirus software detected activity on 31 March, but could not block it as it was set to monitor mode.^[13]

On 13 May the cybersecurity provider for the HSE emailed the Security Operations team that there had been unhandled threats on at least 16 systems since 7 May.^[13] The Security Operations team had the server team restart servers.^[13]

The HSE was alerted to the attack at 4am on 14 May 2021.^[14] The attack affected both national and local systems, involved in all core services, with the HSE taking down their IT system in order to protect it from the attack and to give the HSE time to consider options.^[15]

The attack occurred during the COVID-19 pandemic. Ireland's COVID-19 vaccination programme was not affected by the attack and proceeded as planned;^[7] however, the COVID-19 general practitioner and close contact referral system was down, requiring these individuals to attend walk-in sites rather than attend an appointment.^[16]^[1]

The independent TD (Member of Parliament) Cathal Berry stated that the National Cyber Security Centre which is responsible for the state's cyber security, had only 25 members of staff, a budget of €5 million a year, no dedicated premises, and that its position of Director had been vacant for a year due to its salary of €89,000 a year.^[17]^[18] The National Cyber Security Centre is under the remit of the Department of the Environment, Climate and Communications.^[19]

Perpetrator & methodology

The National Cyber Security Centre identified the penetration testing tool Cobalt Strike, sold by American IT company HelpSystems, as being used to move through and infect HSE and Department of Health systems, to run executable files, and to deploy a variant of the Conti ransomware.^[14]^[20] Cobalt Strike Beacon was detected on infected systems, which allowed them to be controlled and for software to be deployed remotely.^[20]

The group responsible was identified as a criminal gang known as Wizard Spider, believed to be operating from Saint Petersburg, Russia.^[8]^[9]^[10]

Impact

The ransomware cyber attack had a significant impact on hospital appointments across the country, with many appointments cancelled including all outpatient and radiology services.^[21]

Several hospitals described situations where they could not access electronic systems and records and had to rely on paper records.^[22] Some have warned of significant disruption with routine appointments being cancelled, including maternity checkups and scans.^[23]

The COVID-19 testing referral system was made offline, requiring individuals with suspected cases to attend walk-in COVID-19 testing centres, rather than attend an appointment.^[16] The COVID-19 vaccination registration portal was also made offline, but was later back online in the evening.^[24]

The Chief Operations Officer of the HSE – Anne O'Connor – said on 14 May that some cancer and stroke services had been affected and that "the situation will be very serious if it continues into Monday [17 May]". She said that the most serious concerns were with diagnostics, with radiology systems having gone down, affecting CT and other scans from going ahead.^[25] A large amount of out-patient appointments were also cancelled; most community health services are unaffected.^[26] O'Connor also reported that "we don't know what data has been taken", but "we know some data has been compromised", with the Data Protection Commissioner being alerted to the potential breach.^[27]

The HSE published a list of affected services on its website at lunchtime on 14 May 2021.^[28]^[29]

On 19 May, the Financial Times reviewed "samples" of private data of twelve individuals that was published online, including admission records and laboratory results for a man admitted to hospital for palliative care. In response, the National Cyber Security Centre stated criminal gangs "habitually release stolen information as a means of pressurising organisations into paying a ransom". The ContiLocker Team claimed to also have staff employment contracts, payroll data and financial statements, patient addresses, and patient phone numbers.^[11]

On 28 May, the HSE confirmed that data relating to 520 patients, including sensitive information, was published online.^[12]^[30]^[31]^[32]

Hospital disruptions

Hospital disruptions by county^[28]
County	Hospital
Kilkenny	St. Luke's General Hospital
Cavan	Cavan General Hospital
Clare	Ennis General Hospital
Cork	Cork University Hospital Cork University Maternity Hospital
Donegal	Letterkenny University Hospital
Dublin	Beaumont Hospital Children's Health Ireland at Crumlin Coombe Hospital National Maternity Hospital Rotunda Hospital Royal Victoria Eye and Ear Hospital St. Columcille's Hospital St. James's Hospital St. Luke's Hospital Children's Health Ireland at Temple Street Tallaght University Hospital
Galway	University Hospital Galway Merlin Park University Hospital Portiuncula University Hospital
Kerry	University Hospital Kerry
Kildare	Naas General Hospital
Kilkenny	Kilcreene Orthopaedic Hospital
Laois	Midland Regional Hospital, Portlaoise
Limerick	University Hospital Limerick St. John's Hospital, Limerick University Maternity Hospital, Limerick Croom Hospital
Louth	Louth County Hospital Our Lady of Lourdes Hospital, Drogheda
Mayo	Mayo University Hospital
Meath	Our Lady's Hospital, Navan
Monaghan	Monaghan Hospital
Offaly	Midland Regional Hospital, Tullamore
Roscommon	Roscommon University Hospital
Sligo	Sligo University Hospital
Tipperary	South Tipperary General Hospital Nenagh Hospital
Waterford	University Hospital Waterford
Westmeath	Regional Hospital Mullingar
Wexford	Wexford General Hospital

In December 2021 the HSE said that it may take up to four months to contact all those whose data was stolen.^[33] The Garda National Cyber Crime Bureau received the data from the United States Department of Justice through a mutual legal assistance treaty.^[33] The Bureau provided the data to the HSE on 17 December 2021.^[33] The HSE confirmed that said data was taken from its computers.^[33] The HSE also contacted the Data Protection Commissioner about the data.^[33] The data is expected to be a mix of personal data, medical information, HSE corporate information as well as commercial and general personal administrative information.^[33]

Response

The HSE worked with the National Cyber Security Centre, the Garda Síochána, Irish Defence Forces, as well as various partners domestically and internationally, including Europol and Interpol.^[14]^[34]

The Minister of State for Public Procurement and eGovernment – Ossian Smyth – said that the attack was international, not espionage, and that "this is a very significant attack, possibly the most significant cyber attack on the Irish State."^[35]

The HSE claimed that it was a zero-day-threat and that there was no experience in how to respond to the attack.^[36] The Minister for Health – Stephen Donnelly – said that the attack had "a severe impact" on health and social care services.^[36] The Director-General of the HSE – Paul Reid – said that the attack will cost "tens of millions" to fix.^[27]

A number of news outlets, including Bleeping Computer, reported that a ransom demand of €16.5 million (about $20 million) was made, offering to decrypt data and to not publish "private data".^[37]^[38]^[39] Initially, the Business Post reported that a ransom demand of three bitcoin or €124,000 (about $150,000) was made.^[40] Taoiseach Micheál Martin stated the ransom would not be paid, with the attack instead being dealt with in a "methodical way".^[41]^[42]

American cybersecurity firms McAfee and FireEye were contracted by the HSE after the attack to mitigate the damage, and to monitor dark web sites for leaked data.^[43]

On 16 May, it was reported that the Department of Social Protection came under "sustained and fierce attack" but the highly organised criminal group were unable to breach the security. The department subsequently suspended its electronic communication channels with the HSE.^[44]^[39]

On 20 May, Minister for Communications Eamon Ryan said a helpline was to be set up to assist individuals who have had health information published as a result of the hack, and that social media companies were asked to not share information that has been released,^[45] with a High Court injunction obtained by the HSE to prohibit the sharing of this information.^[46]^[47] On the same day, it was reported that the organised cyber crime group provided a decryption key that could enable the HSE to recover their IT systems and the files that hackers locked and encrypted.^[48]^[49] Meanwhile, the public was advised by Gardaí to be aware of a number of call and text scams in the wake of the cyber attack amid warnings the delivery of care in the health service would be a high risk for weeks;^[50]^[51] as of 24 May, the Garda Síochána have described any calls threatening the release of information as "opportunistic", stating they do not have access to private data.^[52]

On 27 May, the Chief Executive of the HSE – Paul Reid – said that the cost of the cyber attack on its IT systems could exceed €100 million.^[53]

The Defence Forces' CIS Corps deployed 'ethical hackers' to fight back against the ransomware attack and sent CIS personnel to hospitals and HSE offices in order to decrypt devices affected onsite. Army Reservists were particularly useful to this effort due to their cybersecurity skills and experienced gleaned from the private sector during their day jobs.^[54]^[55]

On 5 September, during a major operation carried out by Gardaí targeting the gang behind the ransomware attack, the Garda National Cyber Crime Bureau seized several domains used in the cyberattack and other ransomware attacks.^[56]

PricewaterhouseCoopers report

On 10 December a report by PricewaterhouseCoopers was released which revealed that the attackers were in the HSE computer systems eight weeks before the attack was initiated.^[13] The report said that the HSE legacy IT system was not resilient against cyberattacks.^[13] It had evolved over time but had not been designed to resist attacks.^[13]

HSE CEO Paul Reid said that the system had not been strategically designed, but was the result of amalgamation of health boards, hospital groups and Community Healthcare Organisations.^[13] The system is very fragmented and siloed.^[13] In contrast, the HSE staff were described as resilient, working quickly to ensure continuity of services.^[13] Reid also said that the HSE has initiated a number of actions to mitigate future attacks.^[13] These include a 24-hour monitoring system for IT systems in the HSE and more multi-factor authentication for users.^[13]

HSE chairman Ciarán Devine said that the heath service still feels the impact of the attack.^[13]

The HSE has accepted a number of recommendations from the report, including the development of a significant new investment plan and transforming legacy IT to include security.^[13]

New roles of Chief Technology and Transformation Officer and Chief Information Security Officer are to be created.^[13]

The report also recommends security crisis management plans to ensure that responses to futures attacks are properly managed.^[13]

The use of ethical hackers to test system security will be increased.^[13]

Department of Health cyberattack

On 13 May, the National Cyber Security Centre (NCSC) was alerted of "suspicious activity" on Department of Health systems, and in the morning of 14 May an attempt to run ransomware was prevented, with Department of Health IT systems shut down as a precaution.^[39]^[57]^[58] A preliminary investigation by the NCSC showed the use of remote access tool Cobalt Strike, sold by American technology company HelpSystems,^[59] to infect systems and execute the ransomware payload.^[20]

According to RTÉ News, a digital note from the cyber crime group believed to be responsible was left on the Department's IT systems, similar to the one discovered at the HSE.^[60]

Restoration of systems

On 23 June 2021, it was confirmed that at least three quarters of the HSE's IT servers had been decrypted and 70% of computer devices were back in use.^[61]^[62]^[63] By 15 July, this had risen to 82% of servers and 83% of devices.^[64] By September, over 95% of all servers and devices had been restored.^[65]

Legal action

On 25 June 2021, High Court judge Tony O'Connor was told that approximately 27 files stolen from the HSE were placed on a malware analysis service VirusTotal in late May.^[66]^[67] VirusTotal is owned and run by Chronicle Security Ireland Ltd, its US parent Chronicle LLC and ultimately Google.^[68] The stolen files included confidential patient information and was downloaded 23 times before the files were removed on 25 May.^[69]

The defendants – Chronicle Security Ireland and Chronicle LLC – said they wanted to help the HSE as much as possible, but for data protection reasons cannot hand material over unless a court orders them. Therefore, the HSE sought Norwich Pharmacal orders against the defendants to require them to provide information on those who uploaded or downloaded the stolen information. The orders would require the defendants to supply the HSE with the unknown users' email addresses, phone numbers, IP addresses or physical addresses.^[67]

The HSE's national director for operation performance and integration – Joe Ryan – said the HSE became aware that the Financial Times had published an article referring to stolen data and mentioning a link to stolen data. The HSE sought the return of the stolen data and an explanation to the link location but the Financial Times indicated it had received the information from a confidential source which they refused to reveal.^[67]

On 20 May 2021, the HSE had obtained a court order restraining any processing, publishing, sharing or selling of stolen data. When the Financial Times received a copy of the order, they handed over the information they got from the source to the HSE computer security advisers. Analysis of this material revealed that the stolen data had been uploaded to VirusTotal.^[67]

Ryan said that after they were contacted, the defendants deleted the stolen data from their servers.^[67]

Counsel for the HSE told the judge that the matter was urgent but hoped that the matter could be finalised when the matter next comes before the court. The defendant's lawyers said they were unlikely to oppose any order in an agreed form from the HSE to disclose information. The judge, on an ex parte basis, granted counsel permission to serve short notice of the proceedings on the defendants and resumed the matter the following week.^[67]

Notification of affected people

On 9 February 2023, it was revealed that over 32,000 notification letters were issued to people who had their data stolen in the cyber attack. More than 100,000 letters are to be sent to people affected by the attack by April 2023. Dáil Éireann's Public Accounts Committee examined the financial impact and heard that the immediate response cost the Department of Health €1 million and cost the HSE €53 million.^[70]

Impact on cancer treatment

A research team led by Prof Seamus O'Reilly of Cork University Hospital found that in ten cancer trials units (three private, seven public) only two privately-run units had a preparedness plan in place before the attack.^[71] Three of the remaining sites have implemented a plan or are doing so, while file do not have a plan.^[71]

The report also found that patient referrals to cancer clinical trials fell by 85 percent and trial recruitment fell by 55 percent.^[71]

513 patients around Ireland had their radiation therapy interrupted.^[71]

The attack came at the end of the third wave of COVID-19 and 'severely challenged the resilience of the already exhausted staff'.^[71]

Professor O'Reilly said "Covid-19 as an oncologist made me do things professionally that I don’t want to do again. But the cyber-attack was worse than Covid" to the Policy Forum for Ireland keynote seminar ‘Next steps for cancer services in Ireland’.^[71] He also said "It was a very difficult time. Results were frozen on the computer. Our ways of communicating with people were compromised, and we had no access to old information. We had patients who had scans done and the scans were trapped on the machine. It was very challenging for patients because they would turn up at clinics and there would be no records of them coming there or needing to be there. We would have had to send patients home to their GP to get their medical record details, get them printed out at their GP’s office and bring them back to us so we could look after them at the hospital."^[71]

He said that the HSE had improved cybersecurity but warned against complacency.^[71] He said "I think cyber-attacks are becoming more common and more sophisticated, so we’re still vulnerable to them, we’re probably more vulnerable now than we were in May of 2021. A cyber-attack now takes less than 24 hours to activate. the one we had in May 2021; it was embedding for two months. I think we we’re always going to be vulnerable to a cyber-attack. Systems have become more sophisticated to get around whatever we do."^[71]

Legal actions

In May 2024 473 legal actions were reported to have been taken against the HSE in relation to the attack.^[72] The State Claims Agency is managing 12 personal injury cases against the HSE in relation to the attack, where legal proceedings were being served in 11 cases.^[72] The personal injury cases are related to the psychological impact of the attack.^[72] There are a number of cases before the Court of Justice of the European Union related to the attack.^[72]

References

^ ^a ^b "Some health service disruption after HSE cyber attack". RTÉ News and Current Affairs. Retrieved 14 May 2021.
^ "Irish health service hit by 'very sophisticated' ransomware attack". Reuters. Retrieved 14 May 2021.
^ "Irish health service hit by cyber attack". BBC News. Retrieved 14 May 2021.
^ "Ransomware attack disrupts Irish health services". The Guardian. Retrieved 14 May 2021.
^ "Cyber attack 'most significant on Irish state'". BBC News. 15 May 2021. Retrieved 18 May 2021.
^ Lally, Conor (18 May 2021). "Wizard Spider profile: Suspected gang behind HSE attack is part of world's first cyber-cartel". The Irish Times. Retrieved 5 September 2021.
^ ^a ^b "Irish Health Service Shuts Down IT System Amid Cyber Attack". Bloomberg News. 14 May 2021. Retrieved 14 May 2021.
^ ^a ^b Reynolds, Paul (18 May 2021). "Wizard spider: Who are they and how do they operate?". RTÉ News and Current Affairs. Retrieved 18 May 2021.
^ ^a ^b Gallagher, Conor; McQuinn, Cormac. "Dark web 'dump sites' being monitored for HSE data after hack". The Irish Times. Retrieved 18 May 2021.
^ ^a ^b Horgan-Jones, Jack; Lally, Conor. "Scale of damage from cyberattack on HSE systems will not be known for days". The Irish Times. Retrieved 15 May 2021.
^ ^a ^b Noonan, Laura; Shotter, James (19 May 2021). "Irish patients' data stolen by hackers appears online". www.ft.com. Retrieved 19 May 2021.
^ ^a ^b Gallagher, Conor (28 May 2021). "Data of 520 patients published online, HSE confirms". The Irish Times. Retrieved 28 May 2021.
^ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k ^l ^m ⁿ ^o ^p ^q ^r ^s ^t McNally, Tadgh (10 December 2021). "HSE hackers were in health service's computer system for eight weeks before cyber attack". TheJournal.ie. Retrieved 10 December 2021.
^ ^a ^b ^c "What we know so far about the HSE cyber attack". RTÉ News and Current Affairs. 14 May 2021. Retrieved 14 May 2021.
^ Moloney, Eoghan (14 May 2021). "'Serious and sophisticated' - HSE confirms ransomware cyber attack has hit all hospital IT systems". Irish Independent. Retrieved 15 May 2021.
^ ^a ^b Thomas, Cónal (14 May 2021). "Covid-19: GP and close contact referral system down, patients advised to attend walk-in centres". TheJournal.ie. Retrieved 14 May 2021.
^ "Ransomware attack defence upgrade urged by TD for part of Laois and Offaly". Leinster Express. Retrieved 17 May 2021.
^ O'Halloran, Marie. "Cyber security role is vacant because of low salary, TD says". The Irish Times. Retrieved 17 May 2021.
^ "NCSC: Contact Page". www.ncsc.gov.ie. Retrieved 19 May 2021.
^ ^a ^b ^c "Ransomware Attack on Health Sector - UPDATE 2021-05-16" (PDF). National Cyber Security Centre (Ireland). 16 May 2021. Archived (PDF) from the original on 19 May 2021. Retrieved 21 May 2021.
^ "HSE Cyber Security Incident". Health Service Executive (HSE). 19 May 2021. Archived from the original on 18 May 2021. Retrieved 19 May 2021.
^ Brennan, Colin (14 May 2021). "HSE issues defiant statement after 'significant ransomware attack'". Irish Mirror. Retrieved 15 May 2021.
^ Clarke, Vivienne (14 May 2021). "Taoiseach insists Ireland will not pay ransom after HSE cyber attack". BreakingNews.ie. Retrieved 15 May 2021.
^ Heaney, Steven; Clarke, Vivienne; Glennon, Nicole (14 May 2021). "Ransom will not be paid to perpetrators of HSE cyber attack". Irish Examiner. Retrieved 15 May 2021.
^ Moloney, Eoghan (14 May 2021). "Warning of widespread cancellations for HSE patients if ransomware attack not resolved by Monday". Irish Independent. Retrieved 15 May 2021.
^ O'Halloran, Marie. "HSE IT system will take "several weeks" to get back up and running – Donnelly". The Irish Times. Retrieved 19 May 2021.
^ ^a ^b "Paul Reid says it could cost 'tens of millions' to fix HSE IT systems". BreakingNews.ie. 17 May 2021. Retrieved 17 May 2021.
^ ^a ^b "Appointment and service updates – HSE IT system cyber attack". Health Service Executive (HSE). Archived from the original on 16 May 2021. Retrieved 15 May 2021.
^ McDermott, Stephen (14 May 2021). "HSE cyber attack: what services are affected and which ones are still working?". TheJournal.ie. Retrieved 14 May 2021.
^ O'Regan, Eilish (28 May 2021). "Sensitive data of 520 patients has been put online by hackers, HSE reveals". Irish Independent. Retrieved 28 May 2021.
^ Lee, George (28 May 2021). "HSE says stolen sensitive data of 520 patients on dark web". RTÉ News and Current Affairs. Retrieved 28 May 2021.
^ Duffy, Rónán (28 May 2021). "HSE hack: Sensitive data from 520 patients leaked online". TheJournal.ie. Retrieved 3 June 2021.
^ ^a ^b ^c ^d ^e ^f McNally, Tadgh (20 December 2021). "Four months before all people who had data stolen in cyber attack are contacted, says HSE". TheJournal.ie. Retrieved 24 December 2021.
^ Grennan, Dan (16 May 2021). "New cyber attack carried out on Department of Health as HSE scrambles to get systems back online". Extra.ie. Retrieved 16 May 2021.
^ Ní Aodha, Gráinne. "HSE ransomware attack is 'possibly the most significant cyber attack on the Irish State'". TheJournal.ie.
^ ^a ^b Burns, Sarah; Clarke, Vivienne; Lally, Conor; Cullen, Paul. "HSE cyber attack 'possibly the most significant' ever on Irish State". The Irish Times. Retrieved 14 May 2021.
^ Abrams, Lawrence (15 May 2021). "Ireland's Health Services hit with $20 million ransomware demand". Bleeping Computer. Retrieved 16 May 2021.
^ Weckler, Adrian (16 May 2021). "HSE working to restore IT systems amid claims hackers demand $20m for stolen data". Sunday World. Retrieved 16 May 2021.
^ ^a ^b ^c Ryan, Órla; MacNamee, Garreth; McNally, Tadgh; O'Connor, Niall (16 May 2021). "HSE won't comment on ransom figure, as staff are told to 'protect urgent care'". TheJournal.ie. Retrieved 16 May 2021.
^ Woods, Killian; Ryan, Emmet; Rogan, Aaron. "Hackers of HSE computer system demanded bitcoin ransom worth $150,000". Business Post. Retrieved 16 May 2021.
^ Aodha, Gráinne Ní. "HSE confirms ransom has been sought over cyber attack but says it will not be paid". TheJournal.ie. Retrieved 14 May 2021.
^ Horgan-Jones, Jack; Burns, Sarah; Lally, Conor; Cullen, Paul. "Bitcoin ransom will not be paid following cyber attack on HSE computer systems". The Irish Times. Retrieved 15 May 2021.
^ Gallagher, Conor; McQuinn, Cormac. "Dark web 'dump sites' being monitored for HSE data after hack". The Irish Times. Retrieved 20 May 2021.
^ O'Shea, Cormac (16 May 2021). "Hackers tried to breach social welfare system before HSE attack". Irish Mirror. Retrieved 16 May 2021.
^ McConnell, Daniel (20 May 2021). "Helpline for people whose health information will be published by cybercrime gang". Irish Examiner. Retrieved 20 May 2021.
^ Carolan, Mary (20 May 2021). "HSE secures injunctions restraining sharing of hacked data". The Irish Times. Retrieved 20 May 2021.
^ "HSE secures injunction against sharing of stolen data". RTÉ News and Current Affairs. 20 May 2021. Retrieved 20 May 2021.
^ Reynolds, Paul (20 May 2021). "IT experts testing decryption key sent by criminals behind cyber attack". RTÉ News and Current Affairs. Retrieved 20 May 2021.
^ Lally, Conor (20 May 2021). "Cyber gang provides decryption tool to unlock HSE systems". The Irish Times. Retrieved 20 May 2021.
^ O'Regan, Eilish (20 May 2021). "HSE and gardaí investigate scam texts and emails in wake of health service cyber-attack". Irish Independent. Retrieved 20 May 2021.
^ Hennessy, Michelle (20 May 2021). "Warning as fraudsters see HSE hack as opportunity to scam people with calls and texts". TheJournal.ie. Retrieved 20 May 2021.
^ Reynolds, Paul (24 May 2021). "Gardaí not aware of any stolen HSE data published online". RTÉ. Retrieved 24 May 2021.
^ Cullen, Paul (27 May 2021). "Cyberattack will cost HSE at least €100 million to restore and upgrade network". The Irish Times. Retrieved 27 May 2021.
^ O'Connor, Niall (20 July 2021). "Defence Forces deployed 'ethical hackers' to fight back against massive HSE cyber attack". TheJournal.ie. Retrieved 20 August 2021.
^ "Cyber Security in the Defence Forces". Defence Forces Public Relations Branch. 16 July 2021. Retrieved 20 August 2021.
^ O'Sullivan, Colman (5 September 2021). "IT infrastructure of crime group 'significantly disrupted' by gardaí". RTÉ News and Current Affairs. Retrieved 5 September 2021.
^ Lally, Conor (16 May 2021). "Department of Health hit by cyberattack similar to that on HSE". The Irish Times. Retrieved 16 May 2021.
^ Moloney, Eoghan; Molony, Senan; Schiller, Robin (16 May 2021). "Department of Health subjected to separate cyber attack". Irish Independent. Retrieved 16 May 2021.
^ Corfield, Gareth. "We need to talk about criminal hackers using Cobalt Strike, says Cisco Talos". www.theregister.com. Retrieved 21 May 2021.
^ Reynolds, Paul (16 May 2021). "Dept of Health responding to cyber attack since Thursday". RTÉ News and Current Affairs. Retrieved 16 May 2021.
^ Meskill, Tommy (23 June 2021). "Three quarters of HSE IT servers decrypted". RTÉ News and Current Affairs. Retrieved 23 June 2021.
^ Burke, Céimin (23 June 2021). "Three quarters of HSE IT servers decrypted following crippling cyber attack". TheJournal.ie. Retrieved 23 June 2021.
^ Murphy, Eoghan (23 June 2021). "HSE cyberattack: 'Many more weeks' before health services return to normal". Newstalk. Retrieved 23 June 2021.
^ Bowers, Shauna (15 July 2021). "HSE cyberattack: 82% of servers now decrypted". Irish Examiner.
^ Sheils McNamee, Michael (5 September 2021). "HSE cyber-attack: Irish health service still recovering months after hack". BBC News. Retrieved 5 September 2021.
^ O’Loughlin, Ann (25 June 2021). "HSE seeks order to help find who uploaded or downloaded files stolen in cyberattack". Irish Examiner. Retrieved 26 June 2021.
^ ^a ^b ^c ^d ^e ^f O'Faolain, Aodhan (25 June 2021). "Cyberattack: HSE seeks court orders to help identify those who accessed stolen files". The Irish Times. Retrieved 26 June 2021.
^ "Terms of Service – VirusTotal". VirusTotal. Retrieved 27 June 2021.
^ O'Faolain, Aodhan (25 June 2021). "Data stolen in HSE cyber attack downloaded 23 times before being removed, High Court told". TheJournal.ie. Retrieved 27 June 2021.
^ O'Donovan, Brian (9 February 2023). "HSE cyber attack: 32,000 notified of stolen data". RTÉ News. Retrieved 9 February 2023.
^ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ McHale, Michael (21 March 2024). "Cyber-attack had an effect on cancer care 'worse than Covid'". Irish Medical Times. Retrieved 22 March 2024.
^ ^a ^b ^c ^d O'Donovan, Brian (14 May 2024). "More than 470 legal actions taken against HSE over cyberattack". RTÉ News. Retrieved 14 May 2024.

External links

Conti cyber attack on the HSE Independent Post Incident Report (Redacted) - copy of Price WaterhouseCoopers International report on attack
Financial impact of cyber security attack - chapter 12 of Report on the accounts of the Public Services 2021 report on gov.ie
Lessons Learned from the HSE Cyber Attack - from American Hospital Association

[rte-hospital-it-problem-1] "Some health service disruption after HSE cyber attack". RTÉ News and Current Affairs. Retrieved 14 May 2021.

[2] "Irish health service hit by 'very sophisticated' ransomware attack". Reuters. Retrieved 14 May 2021.

[3] "Irish health service hit by cyber attack". BBC News. Retrieved 14 May 2021.

[4] "Ransomware attack disrupts Irish health services". The Guardian. Retrieved 14 May 2021.

[5] "Cyber attack 'most significant on Irish state'". BBC News. 15 May 2021. Retrieved 18 May 2021.

[6] Lally, Conor (18 May 2021). "Wizard Spider profile: Suspected gang behind HSE attack is part of world's first cyber-cartel". The Irish Times. Retrieved 5 September 2021.

[:0-7] "Irish Health Service Shuts Down IT System Amid Cyber Attack". Bloomberg News. 14 May 2021. Retrieved 14 May 2021.

[ws1-8] Reynolds, Paul (18 May 2021). "Wizard spider: Who are they and how do they operate?". RTÉ News and Current Affairs. Retrieved 18 May 2021.

[ws2-9] Gallagher, Conor; McQuinn, Cormac. "Dark web 'dump sites' being monitored for HSE data after hack". The Irish Times. Retrieved 18 May 2021.

[ws3-10] Horgan-Jones, Jack; Lally, Conor. "Scale of damage from cyberattack on HSE systems will not be known for days". The Irish Times. Retrieved 15 May 2021.

[:4-11] Noonan, Laura; Shotter, James (19 May 2021). "Irish patients' data stolen by hackers appears online". www.ft.com. Retrieved 19 May 2021.

[:6-12] Gallagher, Conor (28 May 2021). "Data of 520 patients published online, HSE confirms". The Irish Times. Retrieved 28 May 2021.

[tj-hse-hackers-were-in-health-services-computers-for-eight-weeks-13] ^ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k ^l ^m ⁿ ^o ^p ^q ^r ^s ^t McNally, Tadgh (10 December 2021). "HSE hackers were in health service's computer system for eight weeks before cyber attack". TheJournal.ie. Retrieved 10 December 2021.

[rte-hse-cyber-attack-14] "What we know so far about the HSE cyber attack". RTÉ News and Current Affairs. 14 May 2021. Retrieved 14 May 2021.

[15] Moloney, Eoghan (14 May 2021). "'Serious and sophisticated' - HSE confirms ransomware cyber attack has hit all hospital IT systems". Irish Independent. Retrieved 15 May 2021.

[:2-16] Thomas, Cónal (14 May 2021). "Covid-19: GP and close contact referral system down, patients advised to attend walk-in centres". TheJournal.ie. Retrieved 14 May 2021.

[17] "Ransomware attack defence upgrade urged by TD for part of Laois and Offaly". Leinster Express. Retrieved 17 May 2021.

[18] O'Halloran, Marie. "Cyber security role is vacant because of low salary, TD says". The Irish Times. Retrieved 17 May 2021.

[19] "NCSC: Contact Page". www.ncsc.gov.ie. Retrieved 19 May 2021.

[:5-20] "Ransomware Attack on Health Sector - UPDATE 2021-05-16" (PDF). National Cyber Security Centre (Ireland). 16 May 2021. Archived (PDF) from the original on 19 May 2021. Retrieved 21 May 2021.

[21] "HSE Cyber Security Incident". Health Service Executive (HSE). 19 May 2021. Archived from the original on 18 May 2021. Retrieved 19 May 2021.

[22] Brennan, Colin (14 May 2021). "HSE issues defiant statement after 'significant ransomware attack'". Irish Mirror. Retrieved 15 May 2021.

[23] Clarke, Vivienne (14 May 2021). "Taoiseach insists Ireland will not pay ransom after HSE cyber attack". BreakingNews.ie. Retrieved 15 May 2021.

[24] Heaney, Steven; Clarke, Vivienne; Glennon, Nicole (14 May 2021). "Ransom will not be paid to perpetrators of HSE cyber attack". Irish Examiner. Retrieved 15 May 2021.

[25] Moloney, Eoghan (14 May 2021). "Warning of widespread cancellations for HSE patients if ransomware attack not resolved by Monday". Irish Independent. Retrieved 15 May 2021.

[26] O'Halloran, Marie. "HSE IT system will take "several weeks" to get back up and running – Donnelly". The Irish Times. Retrieved 19 May 2021.

[:3-27] "Paul Reid says it could cost 'tens of millions' to fix HSE IT systems". BreakingNews.ie. 17 May 2021. Retrieved 17 May 2021.

[hse.ie-28] "Appointment and service updates – HSE IT system cyber attack". Health Service Executive (HSE). Archived from the original on 16 May 2021. Retrieved 15 May 2021.

[tj-hse-cyberattack-hospital-health-services-affected-29] McDermott, Stephen (14 May 2021). "HSE cyber attack: what services are affected and which ones are still working?". TheJournal.ie. Retrieved 14 May 2021.

[30] O'Regan, Eilish (28 May 2021). "Sensitive data of 520 patients has been put online by hackers, HSE reveals". Irish Independent. Retrieved 28 May 2021.

[31] Lee, George (28 May 2021). "HSE says stolen sensitive data of 520 patients on dark web". RTÉ News and Current Affairs. Retrieved 28 May 2021.

[tj-hse-hack-data-520-patients-May2021-32] Duffy, Rónán (28 May 2021). "HSE hack: Sensitive data from 520 patients leaked online". TheJournal.ie. Retrieved 3 June 2021.

[tj-four-months-before-all-people-33] ^ ^a ^b ^c ^d ^e ^f McNally, Tadgh (20 December 2021). "Four months before all people who had data stolen in cyber attack are contacted, says HSE". TheJournal.ie. Retrieved 24 December 2021.

[34] Grennan, Dan (16 May 2021). "New cyber attack carried out on Department of Health as HSE scrambles to get systems back online". Extra.ie. Retrieved 16 May 2021.

[tj-hse-cyber-attack-35] Ní Aodha, Gráinne. "HSE ransomware attack is 'possibly the most significant cyber attack on the Irish State'". TheJournal.ie.

[:1-36] Burns, Sarah; Clarke, Vivienne; Lally, Conor; Cullen, Paul. "HSE cyber attack 'possibly the most significant' ever on Irish State". The Irish Times. Retrieved 14 May 2021.

[37] Abrams, Lawrence (15 May 2021). "Ireland's Health Services hit with $20 million ransomware demand". Bleeping Computer. Retrieved 16 May 2021.

[38] Weckler, Adrian (16 May 2021). "HSE working to restore IT systems amid claims hackers demand $20m for stolen data". Sunday World. Retrieved 16 May 2021.

[thejournal16-39] Ryan, Órla; MacNamee, Garreth; McNally, Tadgh; O'Connor, Niall (16 May 2021). "HSE won't comment on ransom figure, as staff are told to 'protect urgent care'". TheJournal.ie. Retrieved 16 May 2021.

[40] Woods, Killian; Ryan, Emmet; Rogan, Aaron. "Hackers of HSE computer system demanded bitcoin ransom worth $150,000". Business Post. Retrieved 16 May 2021.

[41] Aodha, Gráinne Ní. "HSE confirms ransom has been sought over cyber attack but says it will not be paid". TheJournal.ie. Retrieved 14 May 2021.

[42] Horgan-Jones, Jack; Burns, Sarah; Lally, Conor; Cullen, Paul. "Bitcoin ransom will not be paid following cyber attack on HSE computer systems". The Irish Times. Retrieved 15 May 2021.

[43] Gallagher, Conor; McQuinn, Cormac. "Dark web 'dump sites' being monitored for HSE data after hack". The Irish Times. Retrieved 20 May 2021.

[44] O'Shea, Cormac (16 May 2021). "Hackers tried to breach social welfare system before HSE attack". Irish Mirror. Retrieved 16 May 2021.

[45] McConnell, Daniel (20 May 2021). "Helpline for people whose health information will be published by cybercrime gang". Irish Examiner. Retrieved 20 May 2021.

[46] Carolan, Mary (20 May 2021). "HSE secures injunctions restraining sharing of hacked data". The Irish Times. Retrieved 20 May 2021.

[47] "HSE secures injunction against sharing of stolen data". RTÉ News and Current Affairs. 20 May 2021. Retrieved 20 May 2021.

[48] Reynolds, Paul (20 May 2021). "IT experts testing decryption key sent by criminals behind cyber attack". RTÉ News and Current Affairs. Retrieved 20 May 2021.

[49] Lally, Conor (20 May 2021). "Cyber gang provides decryption tool to unlock HSE systems". The Irish Times. Retrieved 20 May 2021.

[50] O'Regan, Eilish (20 May 2021). "HSE and gardaí investigate scam texts and emails in wake of health service cyber-attack". Irish Independent. Retrieved 20 May 2021.

[51] Hennessy, Michelle (20 May 2021). "Warning as fraudsters see HSE hack as opportunity to scam people with calls and texts". TheJournal.ie. Retrieved 20 May 2021.

[52] Reynolds, Paul (24 May 2021). "Gardaí not aware of any stolen HSE data published online". RTÉ. Retrieved 24 May 2021.

[53] Cullen, Paul (27 May 2021). "Cyberattack will cost HSE at least €100 million to restore and upgrade network". The Irish Times. Retrieved 27 May 2021.

[54] O'Connor, Niall (20 July 2021). "Defence Forces deployed 'ethical hackers' to fight back against massive HSE cyber attack". TheJournal.ie. Retrieved 20 August 2021.

[55] "Cyber Security in the Defence Forces". Defence Forces Public Relations Branch. 16 July 2021. Retrieved 20 August 2021.

[56] O'Sullivan, Colman (5 September 2021). "IT infrastructure of crime group 'significantly disrupted' by gardaí". RTÉ News and Current Affairs. Retrieved 5 September 2021.

[57] Lally, Conor (16 May 2021). "Department of Health hit by cyberattack similar to that on HSE". The Irish Times. Retrieved 16 May 2021.

[58] Moloney, Eoghan; Molony, Senan; Schiller, Robin (16 May 2021). "Department of Health subjected to separate cyber attack". Irish Independent. Retrieved 16 May 2021.

[59] Corfield, Gareth. "We need to talk about criminal hackers using Cobalt Strike, says Cisco Talos". www.theregister.com. Retrieved 21 May 2021.

[60] Reynolds, Paul (16 May 2021). "Dept of Health responding to cyber attack since Thursday". RTÉ News and Current Affairs. Retrieved 16 May 2021.

[61] Meskill, Tommy (23 June 2021). "Three quarters of HSE IT servers decrypted". RTÉ News and Current Affairs. Retrieved 23 June 2021.

[62] Burke, Céimin (23 June 2021). "Three quarters of HSE IT servers decrypted following crippling cyber attack". TheJournal.ie. Retrieved 23 June 2021.

[63] Murphy, Eoghan (23 June 2021). "HSE cyberattack: 'Many more weeks' before health services return to normal". Newstalk. Retrieved 23 June 2021.

[64] Bowers, Shauna (15 July 2021). "HSE cyberattack: 82% of servers now decrypted". Irish Examiner.

[bbc-65] Sheils McNamee, Michael (5 September 2021). "HSE cyber-attack: Irish health service still recovering months after hack". BBC News. Retrieved 5 September 2021.

[ie-hse-seeks-order-to-find-who-uploaded-or-downloaded-files-66] O’Loughlin, Ann (25 June 2021). "HSE seeks order to help find who uploaded or downloaded files stolen in cyberattack". Irish Examiner. Retrieved 26 June 2021.

[it-high-court-cyberattack-hse-seeks-court-orders-to-help-identify-those-who-accessed-stolen-files-67] ^ ^a ^b ^c ^d ^e ^f O'Faolain, Aodhan (25 June 2021). "Cyberattack: HSE seeks court orders to help identify those who accessed stolen files". The Irish Times. Retrieved 26 June 2021.

[68] "Terms of Service – VirusTotal". VirusTotal. Retrieved 27 June 2021.

[69] O'Faolain, Aodhan (25 June 2021). "Data stolen in HSE cyber attack downloaded 23 times before being removed, High Court told". TheJournal.ie. Retrieved 27 June 2021.

[70] O'Donovan, Brian (9 February 2023). "HSE cyber attack: 32,000 notified of stolen data". RTÉ News. Retrieved 9 February 2023.

[imt-cyber-attack-had-an-effect-on-cancer-care-worse-than-covid-71] ^ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ McHale, Michael (21 March 2024). "Cyber-attack had an effect on cancer care 'worse than Covid'". Irish Medical Times. Retrieved 22 March 2024.

[rte-news-473-legal-actions-72] O'Donovan, Brian (14 May 2024). "More than 470 legal actions taken against HSE over cyberattack". RTÉ News. Retrieved 14 May 2024.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

[24]

[25]

[26]

[27]

[28]

[29]

[30]

[31]

[32]

[33]

[34]

[35]

[36]

[37]

[38]

[39]

[40]

[41]

[42]

[43]

[44]

[45]

[46]

[47]

[48]

[49]

[50]

[51]

[52]

[53]

[54]

[55]

[56]

[57]

[58]

[59]

[60]

[61]

[62]

[63]

[64]

[65]

[66]

[67]

[68]

[69]

[70]

[71]

[72]

v t e COVID-19 pandemic in the Republic of Ireland
Timeline	2020 2021 2022
Key people	Taoiseach Leo Varadkar Micheál Martin Tánaiste Simon Coveney Leo Varadkar Micheál Martin Minister for Health Simon Harris Stephen Donnelly Chief Medical Officer Tony Holohan Ronan Glynn Breda Smyth Other NPHET members Cillian de Gascun Colm Henry Philip Nolan Paul Reid
Advisory bodies	National Public Health Emergency Team (NPHET) Coronavirus Expert Advisory Group Irish Epidemiological Modelling Advisory Group
Impacts	Society Economy Education Politics Oireachtas Golf Society scandal Katherine Zappone controversy Religion Arts Sports Crime Protests 2021 Dublin riots
Government response	Irish government response to the COVID-19 pandemic COVID-19 vaccination COVID-19 testing COVID-19 Pandemic Unemployment Payment Temporary COVID-19 Wage Subsidy Scheme Employment Wage Subsidy Scheme July Jobs Stimulus Economic Recovery Plan 2021 COVID Tracker Ireland Emergency Measures in the Public Interest (COVID-19) Act 2020 Health (Preservation and Protection and other Emergency Measures in the Public Interest) Act 2020
Outbreaks	Construction sites Direct provision centres Hospitals Nursing homes Processing plants
Media	A Ministerial Broadcast by An Taoiseach Leo Varadkar, TD (March 2020) RTÉ Does Comic Relief (June 2020) RTÉ Investigates: Inside Ireland's Covid Battle (June 2020) Open for Business (July–August 2020 / April–June 2021) RTÉ Investigates: Covid-19 – The Third Wave (February 2021) V Day (June 2021) Cocooned (September 2021)
See also	Health Service Executive ransomware attack