Ireland’s HSE attack was decided in the eight weeks before encryption
The Conti attack on Ireland’s Health Service Executive is remembered for its national scale. Its later independent review showed the outcome was set during nearly eight weeks of undetected access, across three stages: entry, dwell and response.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
In the early hours of Friday, May 14, 2021, the Conti ransomware group encrypted systems across Ireland’s Health Service Executive (HSE), which runs the country’s public health services. The HSE shut down its national IT systems as a precaution, and hospitals across Ireland moved to paper, with heavy disruption to outpatient services, diagnostics and radiology. The Irish government said it would not pay a ransom. During the week of May 17, the attackers provided a decryption tool without payment, though recovery still took months because systems had to be checked and rebuilt before reconnection. The attackers threatened to publish stolen patient data, and the HSE obtained a High Court injunction aimed at preventing its sharing or publication.
The HSE attack is often remembered as the moment ransomware disrupted an entire national health system. The more instructive account came later. In December 2021, the HSE published an independent post-incident review prepared by PwC, and it moved attention from the day of the attack to the weeks before it. For health systems and the agencies that run them, the incident divides into three stages, each with distinct failures and fixes: entry, how the attackers got in; dwell, what happened between entry and encryption; and response, how the organization contained the damage and recovered.
Entry: an ordinary beginning
According to the review, the attack began on March 18, 2021, when a user on an HSE workstation opened a malicious Microsoft Excel file attached to a phishing email. That is about as ordinary as initial access gets. No zero-day vulnerability or exotic supply chain compromise was involved.
Blaming the user misses the design question. In a workforce the size of the HSE’s, someone will always open something they should not. Entry is the stage an organization controls least. Email filtering, blocking macros in files from the internet, attachment sandboxing and training all reduce the rate of successful entry. None eliminates it. Security architecture has to assume some initial access will succeed, and make sure one compromised workstation does not lead quickly to everything else.
That is also where spending decisions start. Money aimed at preventing every entry yields diminishing returns once basic controls are in place. Leaders who measure their programs mainly by phishing click rates are measuring the stage that matters least to the final outcome.
Dwell: eight weeks of missed signals
The review found that the attacker operated inside the HSE environment for nearly eight weeks before deploying ransomware. In that time they moved across the network, compromised highly privileged accounts and reached a large number of systems, including servers in hospitals and the national network. There were signals. The review described alerts from security tools that were not acted on in a way that led to containment. It reported that antivirus software on the first compromised machine was set to monitor mode, so it detected but did not block malicious activity. It noted the HSE lacked a security operations function monitoring around the clock.
This is the decisive stage. Eight weeks is a long time. An organization that can detect lateral movement and privilege escalation, and respond within hours or days, turns a would-be national outage into a contained incident on a few machines. The HSE’s environment, as the review described it, made that very hard: a large, federated estate with many legacy systems, including unsupported operating systems, and a flat network with few barriers to movement.
The investments that shorten dwell are well known. Endpoint detection set to block, with people assigned to act on its alerts at any hour. Separate administrator accounts and tiered privileged access, so a stolen workstation login cannot reach domain controllers. Network segmentation between hospitals, regions and the national core. Each alert needs a named owner and a response time. In a federated health system, segmentation is slow and costly, because shared networks and accounts also make clinical information sharing easy. The HSE experience is the clearest public case for doing it anyway.
Response: shutting down a nation’s systems
When encryption began, the HSE shut down its national network. That limited further damage but meant recovery required re-establishing trust in every system before reconnection. Even with a working decryptor, restoration was slow because the attacker’s access had been so broad. Every server and endpoint needed checking.
The review also noted gaps in preparation for an event of this scale. Tested plans for a cyber incident affecting the whole organization were limited, and critical knowledge sat with a small number of people. Clinical services adapted with notable resilience, but largely through improvisation.
Response also had a data track. The attackers held patient information and threatened to publish it, so the HSE had to pursue legal remedies, monitor for leaks, and prepare to notify the people affected while clinical recovery was still under way. The High Court injunction was an unusual step aimed at limiting onward sharing by legitimate platforms and media. It could not stop criminals, but it gave the organization a lever over the channels most likely to amplify a leak. A health system planning its response should decide in advance who leads this track and which legal options it would pursue.
Response readiness has three parts that can be prepared in advance. Authority: who may disconnect a region or the national network, and on what criteria, without waiting for a meeting. Evidence: offline backups and a known-good inventory of systems, so the organization knows what to rebuild and in what order. Reconnection rules: what checks a hospital or service must pass before it rejoins the network. Organizations that define these in calm conditions shorten recovery by weeks. Those that do not make the decisions under pressure, with incomplete information and the same few experts stretched across every site.
With hindsight
From 2026, the HSE review is among the most cited public post-incident reports in healthcare cybersecurity, largely because it was published and was candid. The HSE set out a multi-year cybersecurity transformation following the review, including stronger security leadership and monitoring. In Europe, the NIS2 Directive, adopted in 2022, broadened cybersecurity obligations for healthcare providers and tightened incident reporting. The dwell pattern recurred. In the Change Healthcare attack of February 2024, UnitedHealth’s chief executive told Congress that criminals entered through a remote access portal without multi-factor authentication and deployed ransomware nine days later. The finding has held up: the size of a ransomware disaster is mostly settled before the ransom note appears, by whether anyone noticed the intruder in the days or weeks between entry and encryption.