The warnings before Ireland's health service shut down

The story

On May 14, 2021, Ireland’s Health Service Executive, which runs the country’s public health care, shut down all of its IT systems nationwide after a ransomware attack. Hospitals went back to paper, and appointments were canceled.

A later investigation traced the attack back two months. A malicious email reached a workstation on March 16, and on March 18 someone opened it and its attached spreadsheet. That gave the attackers a way in, and over the following weeks they spread further.

There were warning signs along the way. On March 31, the antivirus software spotted suspicious activity but was set only to monitor, so it did not block anything. On May 13, the day before the attack, the security provider told the health service that it had seen unhandled threats on at least 16 systems. The response was to restart servers.

The attack used ransomware called Conti. Patient data was also stolen, and some was published online.

Why it mattered

A whole country’s health service ran on paper for weeks, and recovery took about four months even though the attackers handed over a decryption key. An independent review found the health service’s older systems were not built to resist attacks, and that the attackers had been inside for about eight weeks before anyone acted on the warnings.

The lesson today

The attack was seen more than once before it struck. Detection only helps if alerts lead to action: protection set to block threats as well as report them, and someone whose job is to investigate and escalate when it fires.