Loading story…
Ireland’s Data Protection Commission (DPC) fined the Health Service Executive (HSE) €645,000 after unauthorised individuals accessed paper medical records stored at the disused St. Loman’s Hospital in Mullingar and St. Conal’s Hospital in Letterkenny. The investigation began after the HSE reported two breaches in October and November 2023; videos posted to social media by intruders revealed the records held at the sites.
The DPC found that the HSE failed to provide adequate physical security for external document-storage facilities and to preserve the integrity of the archived records. Alongside the financial penalty, imposed on 28 August 2026, the regulator issued a reprimand and ordered the HSE to implement compliance measures and communicate details of the breaches as required.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The DPC issued its final decision, finding failures in the physical security and document integrity of HSE storage facilities, including St. Loman's Hospital in Mullingar and St. Conal's Hospital in Letterkenny. It imposed €645,000 in fines, issued a reprimand and compliance orders, and required the HSE to notify affected data subjects of the breaches.
Ireland's Data Protection Commission commenced an inquiry into the HSE's handling of personal data in paper records stored at external facilities, following the two breach notifications.
The HSE submitted a second personal-data-breach notification concerning unauthorised access to paper medical records at its external storage locations.
The Health Service Executive submitted a personal-data-breach notification concerning unauthorised access to paper medical records held at a disused former psychiatric hospital.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceedpb.europa.eu
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s data-protection authority, CNIL, fined Hôpital privé de la Loire (HPL) **€500,000** over a 2025 breach in which an attacker used a compromised doctor’s account to access its electronic patient-record system. The incident exposed sensitive data for 524,867 patients and 202,246 trusted third parties—more than **727,000 people** in total. A person using the alias “Marak” claimed responsibility; three suspects were arrested in late June in connection with attacks on automated data-processing systems. CNIL found that HPL allowed remote access without a VPN or multifactor authentication, assigned overly broad permissions that enabled one compromised account to reach all patient records, and lacked monitoring capable of promptly detecting prolonged exploration and exfiltration. The authority also found that HPL failed to directly notify affected third parties, violating GDPR Articles 32 and 34. HPL has been ordered to correct the identified deficiencies within deadlines ranging from three to 15 months.
Sep 4, 2026
The Irish Health Service Executive (HSE) has begun offering €750 in compensation to individuals whose personal data was compromised during the major ransomware attack in May 2021. The attack, attributed to the Russia-linked Conti ransomware group, forced the HSE to shut down its IT infrastructure, severely disrupting hospital operations and leading to the exposure of sensitive patient information online. Legal representatives for over 100 affected individuals have confirmed receipt of the compensation offer, which also includes €650 to cover legal costs. This marks the first public acknowledgment by the HSE of the need to compensate victims, with approximately 620 legal proceedings currently underway and nearly 91,000 individuals notified of the breach. Investigations into the incident revealed that the HSE's IT systems were outdated and lacked adequate cybersecurity measures, contributing to the scale of the breach. Since the attack, the HSE has reportedly invested in strengthening its cyber defense capabilities. The compensation offer is intended as a "full and final settlement" for those pursuing legal action, and payments are expected to be processed within 28 days of acceptance. The incident remains the largest cyberattack on a health service computer system in Ireland's history, highlighting the critical need for robust cybersecurity in healthcare organizations.
Jul 12, 2026
Ireland’s Health Service Executive (HSE) was hit by a major **Conti ransomware** attack that forced the shutdown of national health IT systems, disrupted hospital clinics, maternity services, radiology, GP referrals, and parts of Covid-19 testing and contact tracing, while emergency care and the vaccination programme continued. Irish officials said the attack began early on a Friday morning, described it as one of the most serious cybercrime incidents ever faced by the state, and confirmed the government would **not pay** a bitcoin ransom. Investigators also examined related hostile activity, including an attempted intrusion at the Department of Health and earlier distributed denial-of-service activity, while Gardaí, the National Cyber Security Centre, Defence Forces, Europol, and outside cybersecurity experts joined the response. The attackers were reported to have demanded about **$20 million** and claimed to have stolen roughly **700 GB** of data, raising fears that patient and employee information could be leaked on dark-web extortion sites. Recovery was expected to take weeks as the HSE rebuilt systems and shifted many services to manual processes, while the health service sought court injunctions to restrain the sharing of hacked data. The financial fallout later climbed to about **$600 million**, and the long tail of the breach continued years later, with the HSE offering compensation to some victims affected by the system-wide cyberattack.
Jun 29, 2026