The HSE Cyber Attack: What It Cost and What Providers Should Learn

On 14 May 2021 the Health Service Executive shut down its entire national ICT network. It was the most serious cyber attack ever suffered by an Irish public body, and the Comptroller and Auditor General has since audited what it cost and why it happened. For anyone responsible for compliance, data protection or staff training in a healthcare or care setting, the audited findings are more useful than generic awareness material, because they show precisely which failures mattered. Our CPD course library covers healthcare compliance and data protection.

What happened, and the detail most people miss

The attack became visible on 14 May 2021, when Conti ransomware was executed across the HSE's estate. But the initial infection had occurred on a single HSE workstation on 18 March 2021.

That gap is the most important fact in the whole episode. The attackers were inside the network for close to eight weeks before encryption. This was human-operated ransomware, not an automated worm, and it followed the double-extortion pattern: steal the data first, then encrypt, then threaten publication to force payment.

The scale of the environment explains why containment meant shutting everything down. The HSE operated more than 70,000 IT devices across roughly 4,000 locations, on a network whose flat design, PwC later found, exposed the HSE and connected organisations to attacks from one another.

The clinical consequences

Radiation treatment stopped in five centres. The national integrated medical imaging system went offline. Staff reverted to manual workarounds, which slowed services and, as the C&AG records, may have resulted in incomplete clinical records.

Recovery took far longer than the public conversation suggested at the time. Full access was not restored until late September 2021: by 21 September, 100% of servers were considered decrypted and 99% of applications restored — 130 days after encryption. Patient data was stolen, and the HSE has said some of it is irretrievable.

What it cost

The attackers demanded almost $20 million. The HSE did not engage with them and did not pay.

The cost of the attack is nonetheless substantial. For 2021 the HSE recorded roughly EUR 51 million — EUR 37 million revenue and EUR 14 million capital — excluding voluntary agencies. A further EUR 4.4 million of revenue costs fell into 2022, mainly for Microsoft Office 365, with legal costs of EUR 2.6 million between May 2021 and July 2022. Recurrent ICT funding was increased by EUR 43 million from 2022.

The forward figure is the striking one. The HSE's initial estimate for implementing PwC's recommendations was almost EUR 657 million over seven years. The C&AG is explicit that the full cost has never been quantified, because the costs of voluntary agencies, staff time and manual record-keeping were excluded.

The failures were known in advance

This is the part that should concentrate the mind of anyone holding a risk register.

Internal audits in 2018 and 2019 had identified unsupported software and weak backup standards. The HSE accepted those recommendations. Cyber risk sat on the corporate risk register, and the audit and risk committee was briefed on it in February 2020 and again in March 2021 — two months before the attack.

Security monitoring before the attack covered 8am to 6pm on weekdays only, with on-call support outside those hours. The initial infection on 18 March sat undetected for weeks within that arrangement. Monitoring is now round the clock.

PwC described an IT estate that had evolved rather than being designed for resilience and security, with over-reliance on legacy systems. None of that was a surprise on 14 May 2021. It was documented, accepted, and not yet fixed.

What this means for a care provider or healthcare employer

Few organisations have 70,000 devices, but the failure modes scale down intact.

Dwell time is the metric that matters. Eight weeks of undetected access is what turns an infected workstation into a national incident. Ask what would detect unusual activity in your environment, and when — including outside office hours.

A backup is not a recovery plan. The 2019 internal audit flagged backup standards. The test that counts is a restore, performed and timed, not a backup taken.

Flat networks turn one compromise into all of them. If a connected partner organisation is breached, what reaches you? The C&AG recommended the HSE review its trust relationships with other bodies.

Manual workarounds create a records problem as well as a service problem. If your continuity plan assumes paper, decide now how those records are reconciled into the clinical record afterwards, and who is accountable for it.

Notification is slower and harder than anyone plans for. As of August 2022 — more than a year after the attack — affected individuals had still not been informed. Our guide to data breach and cyber incident response for care providers sets out the sequence, and ransomware and cyber incident response covers the operational side.

Implementation is a long road

PwC's review contained 83 key recommendations, which the HSE puts at 245 including sub-recommendations. As of June 2022, three had been fully implemented. The C&AG recommended the HSE set clear deliverables, costs and timelines, replace unsupported systems holding personal data, review its trust relationships, and inform everyone whose data was taken.

For smaller organisations the lesson is not that remediation takes seven years and EUR 657 million. It is that the cheap controls — segmentation, tested restores, out-of-hours monitoring, and staff who recognise the initial phishing attempt — are the ones that would have changed the outcome. For UK organisations, the equivalent annual assurance exercise is covered in our guide to the Data Security and Protection Toolkit deadline.

Frequently asked questions

Did the HSE pay the ransom?

No. The HSE states it did not engage with the attackers and did not pay. Recovery still took until late September 2021.

How long were the attackers in the network?

The initial infection was on 18 March 2021 and the ransomware was executed on 14 May 2021 — close to eight weeks.

What did the attack cost?

Around EUR 51 million in 2021 for the HSE excluding voluntary agencies, plus further costs in 2022 and an estimated EUR 657 million over seven years to implement the review's recommendations. The full cost has not been quantified.