Cyber Incident Victim: Department of Health
Date:
May 2021
Location:
Ireland
Summary
A ransomware attack targeted Ireland's healthcare system, attributed to the Eastern European-based 'Wizard Spider' group, impacting the Department of Health and Health Service Executive. Specialists prevented ransomware activation within the department's systems but not the HSE, leading to substantial outpatient cancellations and temporary closure of the COVID-19 vaccine portal. Authorities refused ransom demands, coordinated with international law enforcement including Europol, and prioritized service restoration amid what was described as the state's most significant cyber incident. Recovery efforts faced delays, with full system restoration expected to take several days.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On May 13, 2021, Ireland's National Cyber Security Centre (NCSC) detected malware inserted into systems at the Department of Health, followed by a separate attack on the Health Service Executive (HSE) the next day. The NCSC attributed both incidents to the Eastern European cybercrime group 'Wizard Spider'. Specialists successfully prevented ransomware from activating within the Department of Health's systems but were unable to contain the attack at the HSE, where the ransomware detonated. This resulted in widespread system disruptions across Ireland's public healthcare infrastructure. Digital ransom demands were issued by the attackers, though the Irish government immediately declared it would not pay any ransom to restore systems.
The HSE attack represented the most significant cyber incident in Irish state history, forcing the temporary shutdown of the COVID-19 vaccine portal on May 14 and causing substantial outpatient service cancellations nationwide. Authorities projected several days before full system restoration could occur, though vaccination programs continued with 250,000 doses scheduled for administration the following week. Taoiseach Micheál Martin received briefings from the NCSC and HSE leadership, while Justice Minister Heather Humphreys consulted with Garda Commissioner Drew Harris and the National Cybercrime Bureau. Investigators shared digital evidence with Europol's Malware Analysis Centre in The Hague and coordinated with international law enforcement partners. Government priorities focused on restoring medical services while maintaining refusal to negotiate with attackers, despite ongoing operational disruptions across healthcare facilities.