| 4.6°C Dublin

exclusive Ransom demanded by cybercriminals in HSE attack but officials insist: ‘we won’t pay... it would open up Pandora’s Box’ 

  • Ransom demanded by gang this evening
  • Taoiseach says no ransom will be paid
  • HSE cyber-attack ‘appears to be by international criminals’, could run into next week – Leo Varadkar
  • ‘This is having a severe impact on our health and social care services today’ – Health Minister
  • HSE insists it won’t pay any ransom, says it has backups “for all the big stuff”
  • Some cancer treatment may not go ahead
  • Cyber attack is not affecting ongoing Covid-19 vaccination programme, but GPs unable to complete test referrals


HSE chief Paul Reid. Photo: Frank McGrath

HSE chief Paul Reid. Photo: Frank McGrath

HSE chief Paul Reid. Photo: Frank McGrath

A ransom has been sought following the cyber attack on the HSE computer system.

The HSE has insisted it will not pay any ransom to hackers in the nationwide ransomware attack, its bosses have insisted.

“It’s government policy that we don’t pay ransoms,” the HSE’s chief information officer, Fran Thompson, told the Irish Independent.

“And we have no intention of doing so here. It would open up a Pandora’s Box.”

It has emerged this evening that the hackers have since demanded a ransom, but full detail on the demands have not been revealed yet.

Taoiseach Micheál Martin said this evening it has been made “very clear” that no ransom will be paid.

He declined to say who the “international criminals” that are the behind the attack and how much ransom they have asked for.

“We’re dealing with this in accordance with advice that we have received from cyber security experts. I think we’re very clear we’re not going to be paying any ransom or engaging in any of that sort of stuff.”

He said it is not yet clear if patient data has been compromised.

“People with the know-how are on this case,” he said.

Speaking at government buildings, he said that the impact of the attack will be assessed in the coming days.

“We have the people in place, the have the capacity and we have the systems in place to deal with this,” he said.

Daily Digest Newsletter

Get ahead of the day with the morning headlines at 7.30am and Fionnán Sheahan's exclusive take on the day's news every afternoon, with our free daily newsletter.

This field is required

“The impact is something that has to be dealt with in a methodical way.

“It will take some days to assess the impact and that is the proper way to do this,” he told reporters.

HSE’s chief information officer Mr Thompson said that the organisation was prepared

“These people always look for a ransom,” he said.

Last year, the average ransom paid across European ransomware attacks was almost €300,000, according to IT security industry figures.

The specific ransomware attack currently affecting the HSE and regional hospitals is called Conti. Employed by criminal gangs, it is sometimes used to extort two separate ransoms — one to unlock the data frozen by the hackers and one as a payoff not to publicly release sensitive data that is stolen in the process.

However, the HSE says that it does have key systems and data backed up.

“Yes, we do have backups,” said Mr Thompson. “All the big stuff, anyway.”

It is understood that the HSE has brought in IT security companies McAfee and FireEye to assist. It is also working with the National Cyber Security Centre.

However, Mr Thomson said that the HSE’s initial assessment of the cyberattack is that it involves a ‘Zero Day’ attack. This means that there is a vulnerability in some hardware or software which would make the malware undetectable by conventional anti-virus or security software.

Mr Thomson’s comments come as Tánaiste Leo Varadkar said that the cyber attack appears to be a ransomware attack by international criminals.

The attack could run into the weekend and into next week, he said.

The attack is having an impact across the HSE services including in hospitals and community facilities.

The HSE is liaising with the National Cyber Security Centre which has activated its crisis management plan, and also briefed Communications Minister Eamon Ryan and Junior Minister Ossian Smyth this morning.

Hospitals have told staff not to use their computers. This blocks off their access to patient electronic records and a vast amount of other information.

The HSE’s Covid-19 Testing and Tracing system has been impacted by the cyber attack on the health service.

It is expected this will result in a delay in people receiving Covid-19 test results and they are being asked to continue to self-isolated until they are contacted.

People who have testing appointments today can attended their appointments in the designated testing centre.

The GP referral system for Covid tests will not be in operation today because of the HSE shut down their IT systems to contain the so called ransomware attack. This means that GPs cannot currently refer new people for Covid-19 testing at one of the HSE testing sites.

GPs will advise you to attend a walk in facility if you need testing. Walk in testing will be prioritised for symptomatic people and close contacts of confirmed Covid cases.

The HSE has moved all contact tracing to two contact tracing sites which remain operational.

They said contact tracers will call you with detected results and will gather the required data.

“Importantly they will gather close contact information and call close contacts to ask them to attend a walk in site for testing .This process may take longer than usual and we appreciate the public's patience as we work through this,” a HSE statement said.

“We continually advise the public to follow the HSE public health advice including wearing masks, maintaining social distance, practising good hand hygiene and keep contacts to a minimum but it is particularly important that everyone follows this advice while we are dealing with this IT issue which has had a significant impact on our Test and Trace service,” it added.

They added if "you are awaiting test results - people who had a recent COVID 19 swabbing appointment and are awaiting their results will still have their tests processed in our laboratories.

"There may be some delay in receiving your test results, we are asking the public to bear with us while we implement a new process to provide results with an initial focus on detected results.

"It is critical that anyone who is awaiting a COVID 19 test result, self isolates until they receive their test result. This is an important change from the usual restricting movements advice."

Some cancer treatments are also not going ahead because of the shutdown of the health service’s IT system, along with some maternity and other appointments..

The Tánaiste confirmed that the vaccine rollout, emergency services, ambulance services, GP systems and pharmacy systems are not affected.

Mr Varadkar confirmed that there are now "major problems" in appointments for cancer patients who need radiation oncology services.

"Major problems now in radiology, when people are getting scans, also radiation oncology, which will be cancer patients.

"The advice that we're giving people is that if you have an appointment, keep that appointment. Don't contact us, we'll contact you," he added.

In an update this afternoon, the HSE said: “There has been a ransomware attack on our IT systems. We have shut them all down as a precaution.

“This has caused some disruption to our services. But most healthcare appointments will go ahead as planned.”

"You cannot get a test through your GP today. This is because the referral system is not working,” the HSE advised.

Emergency departments (EDs) are still open for emergencies and are here to help in all medical emergencies, although the HSE said there could be delays.

In particular, if you or someone else is showing signs of a stroke or heart attack, do not be afraid to go to your local ED. Call 112 or 999 immediately for emergency help, the HSE advised.

The HSE gave updates to the situation in a number of hospitals (detailed below), but told patients to attend scheduled appointments unless otherwise advised.

Rotunda Maternity Hospital

All appointments at the Rotunda Maternity Hospital in Dublin have been cancelled except for:

• appointments for women 36 weeks pregnant or later

• emergencies

Cork University Hospital

Radiotherapy appointments are cancelled.

Most X-ray appointments are also cancelled. Patients will be contacted if their appointment is going ahead.

Go to your appointment if it is for any of the following:

• chemotherapy

• out-patient appointment

• surgery

CUH will contact patients whose appointments are cancelled.

Only emergency blood samples are being sent to the lab today.

University Hospital Limerick Group

UHL warned of long delays, but emergency services are continuing, and outpatients with appointments should still attend.

The hospital group pointed to a range of alternatives to emergency departments including family doctors, out-of-hours services and local pharmacies.


The information systems of Túsla, the child and family agency, have also been hit in the ransomware attack.

It means normal child-referral systems for State intervention and support have been knocked out, at least temporarily.

A Government official confirmed: “Túsla systems are also currently not operating, and this includes email, internal systems and the portal through which child protection referrals are made.”


Health Minister Stephen Donnelly said the HSE and the Department of Health are working to ensure that the HSE’s systems and information are protected.

“This is having a severe impact on our health and social care services today, but individual services and hospital groups are impacted in different ways. Emergency services continue, as does the National Ambulance Service,” Minister Donnelly said on Twitter.

With regards to cancer treatments, medical and nursing staff do not have access to new test results for people with serious illnesses including cancer.

However, doctors are requesting paper-based results from outlets such as laboratories.

It has meant hospitals have been contacting several patients, who were due to arrive for outpatient appointments, to inform them they are postponed.

Hospitals are keen to stress that patients cared for in hospital are safe.

A range of virtual consultations between specialists and patients, which have become more common since the pandemic, also cannot go ahead. Any patient who is in an emergency situation is advised to turn up to hospital, where all staff are on duty.

Electronic prescriptions for medicines are not affected.

The HSE is currently giving regular updates on its Twitter feed: www.twitter.com/hselive

At today’s Nphet briefing chief medical officer Dr Tony Holohan said the Department of Health has also had an impact in the Department of Health.

He said this afternoon that officials in the Department are not able to receive emails.

He said that the attack should not "distract us" and that the symptoms for coronavirus are the same.

Related topics

Most Watched