Ransomware
Ireland HSE Conti Ransomware Attack (National Health System Shutdown, β¬100M+)
Primary Source βIncident Details
On May 14, 2021, Conti ransomware operators attacked Ireland’s Health Service Executive (HSE) β the country’s entire national public health system β encrypting approximately 80,000 devices and all HSE IT systems. This was among the most disruptive ransomware attacks on a national health system in history. Ireland’s entire national health IT infrastructure was shut down: hospitals reverted to paper systems, COVID-19 vaccination booking systems were taken offline, radiology and diagnostic imaging systems were inaccessible, and cancer screening programs were cancelled. The attackers demanded $20 million in ransom. The Irish government refused to pay. In a rare development, the Conti group voluntarily provided a free decryptor following a public backlash and claims the attack was unauthorized by senior leadership. Remediation took many months. The official post-incident review estimated total costs of over β¬100 million (recovery, lost productivity, IT upgrades). The initial intrusion occurred through a phishing email on March 16, giving attackers an 8-week dwell time to map the network before striking. The incident demonstrated how ransomware could effectively disable an entire nation’s healthcare infrastructure.
Technical Details
- Initial Attack Vector
- Phishing email delivered to a workstation on March 16, 2021; the workstation had a Cobalt Strike beacon installed, enabling remote access; attackers spent 8 weeks conducting reconnaissance before deploying Conti ransomware on May 14, 2021
- Malware Family
- Conti ransomware; Cobalt Strike
Timeline
- 2021-05-14 Breach occurred
- 2021-05-14 Publicly disclosed
- 2021-05-14 Customers notified