HSE examining newly discovered trove of stolen data

Patients have been urged not to contact the HSE or their medical teams as analysis of the newly discovered cache is expected to take 12 to 16 weeks. Picture: Dominic Lipinski/PA Wire

The HSE is examining a newly discovered trove of data stolen in last May's cyber attack to identify patients whose information was affected, following an agreement between gardaí and the American Department of Justice.

It is not yet known how many people are potentially affected, but the data is understood to contain personal information including phone numbers and addresses as well as medical treatment details.

Patients have been urged not to contact the HSE or their medical teams as analysis of the newly discovered cache is expected to take 12 to 16 weeks.

This new discovery of theft during the devastating cyberattack in May of this year is expected to include a mix of personal data, medical information, HSE corporate information, commercial data and general non-personal administrative data.

The HSE said on Monday that gardaí gave them a copy of this stolen data on Friday, having obtained it from the Department of Justice in the United States under a Mutual Legal Assistance Treaty (MLAT) which was processed by the American courts.

They have “seen no evidence at this point that this stolen data has been published online or used for any criminal purposes,” a spokeswoman said.

The Data Protection Commission (DPC) has been informed.

“The HSE is reviewing this material to identify any individuals whose personal data was stolen and will notify the relevant data controller as required and affected individuals as required following engagement with the DPC,” the spokeswoman said.

Cybersecurity staff at the HSE are continuing to work with the Gardai, and have so far seen “seen no evidence of inappropriate use of stolen or copied data” during improved monitoring, including use of a specialist service.

This includes through more mainstream publications and on the dark web. The dark web is a part of the internet that can only be accessed through a specialised web browser, and activity is anonymous. It is used in some countries to evade dictatorial authorities but is also frequently used by criminals.

Information in this bundle is expected to include names, addresses and phone numbers, while medical information would include records, notes and treatment histories.

A High Court order has been in place since May 20 stopping publication of stolen data linked to the cyberattack by the Russia-based Conti ransomware gang.

In July a legal case was lodged in Cork Circuit Cork by a male cancer patient, being treated at the Mercy University Hospital, whose data was stolen during the hack.

Solicitor Micheal O’Dowd, who took that case, said recently: “From our point of view we have issued numerous proceedings under Article 82 GDPR against the Mercy Hospital Cork, and have instructions to proceed against the HSE.” 

On Friday a review published by the HSE into how the attack took place found the health services had “frail” cybersecurity systems, and the criminal gang spent eight weeks roaming the systems before the attack.

The review, carried out by PWC, found alerts were raised about suspicious activity during that time but not acted on due to a “low-level of cybersecurity maturity”. It recommended significant long-term investment to protect patients' data.