INCIDENT REPORT · CP-2021-003

Ireland HSE Conti ransomware attack

L4 · CRITICALCONFIRMED

Ireland's national health service was hit by Conti ransomware in the early hours of 14 May 2021. More than 80% of its IT environment was affected.

Incident ID: CP-2021-003
Incident date: 14 MAY 2021
Detection date: 14 MAY 2021
Affected countries: Ireland
Plotted location: Dublin, Ireland (Affected organization headquarters)
Threat classification: Level 4 — CRITICAL
Classification rationale: Nationwide disruption to an essential public health system.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Malware infection followed by about eight weeks of undetected attacker presence before Conti ransomware was executed (PwC post-incident review)
Sectors: Healthcare, Government
Critical infrastructure: Yes
Organizations affected: Health Service Executive (HSE)
Operational consequences: 31 of 54 acute hospitals cancelled services ranging from surgery to radiotherapy. The independent review found high-risk gaps in 25 of 28 critical cybersecurity controls.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the HSE (independent PwC post-incident review) to Conti ransomware operators

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Ireland HSE Conti ransomware attack

L4 · CRITICALCONFIRMED

Ireland's national health service was hit by Conti ransomware in the early hours of 14 May 2021. More than 80% of its IT environment was affected.

Incident ID

CP-2021-003

Incident date

14 MAY 2021

Detection date

14 MAY 2021

Affected countries

Ireland

Plotted location

Dublin, Ireland (Affected organization headquarters)

Threat classification

Level 4 — CRITICAL

Classification rationale

Nationwide disruption to an essential public health system.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Malware infection followed by about eight weeks of undetected attacker presence before Conti ransomware was executed (PwC post-incident review)

Sectors

Healthcare, Government

Critical infrastructure

Yes

Organizations affected

Health Service Executive (HSE)

Operational consequences

31 of 54 acute hospitals cancelled services ranging from surgery to radiotherapy. The independent review found high-risk gaps in 25 of 28 critical cybersecurity controls.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the HSE (independent PwC post-incident review) to Conti ransomware operators