enforcement-actionbreach-disclosure-notificationhealthcare-sector-threatprivacy-surveillance-policy

Irish HSE Fined €645,000 Over Exposed Medical Records at Disused Hospitals

Regulatory & Policy · 3 sources · Updated 2mo ago · First seen Sep 1, 2026

Ireland’s Data Protection Commission (DPC) fined the Health Service Executive (HSE) €645,000 after unauthorised individuals accessed paper medical records stored at the disused St. Loman’s Hospital in Mullingar and St. Conal’s Hospital in Letterkenny. The investigation began after the HSE reported two breaches in October and November 2023; videos posted to social media by intruders revealed the records held at the sites.

The DPC found that the HSE failed to provide adequate physical security for external document-storage facilities and to preserve the integrity of the archived records. Alongside the financial penalty, imposed on 28 August 2026, the regulator issued a reprimand and ordered the HSE to implement compliance measures and communicate details of the breaches as required.

What this changes for youSee the reporting duties and controls this puts on the clock.

Get the context

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Oct 2023 – Aug 28, 2026

Aug 28, 20262mo ago
Irish DPC fines HSE €645,000 over insecure medical-record storage
The DPC issued its final decision, finding failures in the physical security and document integrity of HSE storage facilities, including St. Loman's Hospital in Mullingar and St. Conal's Hospital in Letterkenny. It imposed €645,000 in fines, issued a reprimand and compliance orders, and required the HSE to notify affected data subjects of the breaches.
IE: HSE fined €645,000 over data breach affecting Westmeath hospital - Malware News - Malware Analysis, News and Indicators
May 24, 20242y ago
Irish DPC opens inquiry into HSE paper-record storage
Ireland's Data Protection Commission commenced an inquiry into the HSE's handling of personal data in paper records stored at external facilities, following the two breach notifications.
Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) | European Data Protection Board
Nov 2023
HSE reports second paper-records data breach to Irish DPC
The HSE submitted a second personal-data-breach notification concerning unauthorised access to paper medical records at its external storage locations.
Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) | European Data Protection Board
Oct 2023
HSE reports first paper-records data breach to Irish DPC
The Health Service Executive submitted a personal-data-breach notification concerning unauthorised access to paper medical records held at a disused former psychiatric hospital.
Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) | European Data Protection Board

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Breaches

1 linked

HEALTHSERVICEEXECUTIVE-2023-10

Do you run this?See what this changes for your reporting obligations and which controls it puts on the clock.

Get the Regulatory Context

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

CyberveilleNews · Sep 4, 2026

Irlande : 645 000 € d'amendes pour des violations de données psychiatriques dans des hôpitaux abandonnés | CyberVeilleOpen source ↗

Edpb EuropaNews · Sep 3, 2026

Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) | European Data Protection BoardOpen source ↗

Malware NewsNews · Sep 1, 2026

IE: HSE fined €645,000 over data breach affecting Westmeath hospital - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Irish HSE Fined €645,000 Over Exposed Medical Records at Disused Hospitals

How this story unfolded

Irish DPC fines HSE €645,000 over insecure medical-record storage

Irish DPC opens inquiry into HSE paper-record storage

HSE reports second paper-records data breach to Irish DPC

HSE reports first paper-records data breach to Irish DPC

Related entities

Breaches

Sources

See the full picture, correlated to your attack surface.

Related stories

French Hospital Fined €500,000 After Patient-System Breach Exposes 727,000 People

Irish Health Service Offers Compensation to Victims of 2021 Ransomware Attack

Conti Ransomware Crippled Ireland’s Health Service and Exposed Stolen Data

Irish HSE Fined €645,000 Over Exposed Medical Records at Disused Hospitals

How this story unfolded

Irish DPC fines HSE €645,000 over insecure medical-record storage

Irish DPC opens inquiry into HSE paper-record storage

HSE reports second paper-records data breach to Irish DPC

HSE reports first paper-records data breach to Irish DPC

Related entities

Breaches

Sources

See the full picture, correlated to your attack surface.

Related stories

French Hospital Fined €500,000 After Patient-System Breach Exposes 727,000 People

Irish Health Service Offers Compensation to Victims of 2021 Ransomware Attack

Conti Ransomware Crippled Ireland’s Health Service and Exposed Stolen Data