Irish Health Service Executive cyberattack (HSE, 2021)
A ransomware attack that forced Ireland's public health service to shut down all of its IT systems on May 14, 2021, without any ransom being paid.
The Health Service Executive runs most public hospitals and health services in Ireland. The attackers got in two months before encrypting anything, through a booby-trapped email opened on a single workstation, then moved through the network without being stopped. On the day of encryption, the service shut down all its systems as a precaution, which sent hospitals back to paper for weeks. The government refused to pay, in line with its public position, and obtained a court order barring distribution of the stolen data. The independent report published afterward mostly described ordinary failures: alerts seen but not acted on, no round-the-clock monitoring center, legacy systems. That ordinariness is what makes it a reference case for underwriting.
According to the PwC report published in December 2021, the first workstation was infected on March 18, 2021 by a malicious Excel file, and the Conti group launched encryption on May 14. On May 20 the attackers handed over the decryption tool for free, without having received a ransom, but restoring its systems took months.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.