HSE still to contact victims of 2021 cyberattack

The HSE CEO would not be drawn as to how many people may have been affected by the attack, which crippled the HSE’s online systems at a repair cost of €58m in 2021 alone. File Picture: iStock

The HSE has yet to contact any of the people whose personal data was compromised during the May 2021 cyberattack on its computer systems.

Acting CEO of the HSE, Stephen Mulvany, told the Public Accounts Committee that while "a significant volume of work is progressing” in terms of contacting people whose data was affected by the attack, “we haven’t made any specific contacts yet”.

Mr Mulvaney, who has taken over from the departing Paul Reid, said the work underway is targeted at “getting to a point where we can appropriately communicate with those individuals who need to be communicated with”.

“We’re very anxious to do so in a way that does not cause unnecessary upset,” Mr Mulvany said under questioning from Sinn Féin’s Matt Carthy. He said he is “conscious this may be taking longer than people might expect”. 

“However, the volume and complexity of what we’re dealing with is quite substantial,” he added. Contact would finally be made “in the coming months” he said.

What's your view on this issue?

You can tell us here

The CEO would not be drawn as to how many people may have been affected by the attack, which crippled the HSE’s online systems at a repair cost of €58m in 2021 alone.

He likewise said it would be “inappropriate” to comment regarding the risk ratings attributed to the various breaches, while the number of people affected was likewise not forthcoming.

Chief operating officer Damian McCallion said the initial contacts to be made with those whose data had been breached would be done by a team which has been put together specifically for that purpose.

“The team is stood up and ready to move,” Mr McCallion said, adding that part of the team will be made up of former Covid-19 contact tracers who have been reassigned.