On 14 May 2021, Ireland’s Health Service Executive (HSE) shut down nationwide IT systems after a ransomware intrusion attributed to the criminal group Wizard Spider, believed to operate from Russia and associated with Conti. Investigators said the attackers entered through a malicious email sent on 16 March and opened on 18 March, then used a Microsoft Excel file and Cobalt Strike to move through HSE networks. Antivirus software detected activity on 31 March but was operating in monitor-only mode; a PricewaterhouseCoopers report released on 10 December 2021 found the attackers had remained inside the network for about eight weeks. The HSE’s fragmented legacy infrastructure had not been strategically designed for cyber resilience.
The shutdown disrupted hospital appointments, radiology, cancer services, maternity checkups, COVID-19 testing referrals and access to electronic patient records, forcing some facilities to use paper systems. On 28 May 2021, the HSE confirmed that confidential information involving 520 patients had been published online; more than 32,000 notification letters had been issued by February 2023, with over 100,000 planned. Cancer-trial referrals fell 85%, recruitment fell 55%, and radiation therapy for 513 patients was interrupted. The HSE estimated recovery costs above €100 million, while the Department of Health’s Public Accounts Committee later recorded €53 million in HSE response costs. The organization accepted recommendations for stronger monitoring, multifactor authentication, crisis planning and new technology-security leadership, while hundreds of legal actions followed.
