Estimated reading time: 4 minutes
Numerous Legal Proceedings
The Conti ransomware attack HSE – on Ireland’s Health Service Executive in 2021 has led to numerous legal proceedings. The case was referred or related to the Court of Justice of the European Union (CJEU) (often referred to as the EU court or European Court of Justice).
Solicitor To Client – 25th – Feb – 2026
“There is a process going forward where pleadings are exchanged between our office and the HSE solicitors before we can get to a point of obtaining a trial date for you in Cork Circuit Court. That process is likely to take approx. 18 months from now to see through. I will let you know in time once we have a trial date”.
The Conti HSE data breach in Ireland refers to the major ransomware cyberattack on the Health Service Executive (HSE), Ireland’s public healthcare system. The attack occurred on May 14, 2021. This incident is widely regarded as the largest cyberattack on a national health service and one of the most significant on an Irish state agency. As a result, it caused widespread disruption to IT systems, encrypted files, and exposed personal data of patients and staff.
Key Details of the Attack
- Perpetrators — The attack was carried out by the Russia-linked Conti ransomware group (also associated with Wizard Spider), a sophisticated ransomware-as-a-service operation.
300,000 Window – 7 Systems – Unpatched Contributed - How it happened — The breach began earlier (around March 16–18, 2021) when an HSE employee opened a malicious Microsoft Excel file attached to a phishing email. This allowed initial access. Afterward, attackers used tools like Cobalt Strike for lateral movement within the network over several weeks. On May 14, they deployed Conti ransomware, encrypting files (adding a .FEEDC extension) and exfiltrating sensitive data. As a result, outdated antivirus and unpatched systems contributed to the success.
- Immediate impact — All HSE IT systems nationwide were shut down to contain the threat. This caused massive disruption during the COVID-19 pandemic. Hospitals reverted to paper records, appointments were canceled, and services (including cancer treatments and radiation therapy) were severely affected. Patient care was compromised.
- Ransom demand — Conti demanded approximately $20 million (about €19 million at the time) for decryption keys and to not publish stolen data. However, Ireland’s government refused to pay.
- Decryptor provided — Surprisingly, Conti later supplied a free decryption tool (while still threatening to sell or leak the data).
- Data breach aspect — Attackers stole large amounts of sensitive personal and medical data (including patient records). Some data appeared on the dark web or was threatened for sale. The Department of Health was also targeted.
Aftermath and Recovery
- Recovery efforts were extensive and costly, with estimates for repairs, upgrades, and response exceeding €100 million. Some reports suggest up to €600 million in total impacts.
- A detailed independent review (by PwC, published December 2021) highlighted vulnerabilities like poor patching, inadequate monitoring, and failure to act on prior alerts.
- Long-term effects included ongoing service disruptions and heightened focus on cybersecurity in Irish healthcare.
Recent Developments (as of late 2025)
Insulting compensation offers by HSE
- Over four and a half year later since May 2021 – In December 2025 the HSE announced an insulting compensation offers of €750 to affected individuals whose personal data was compromised. Additionally, there was a €140.00 form registration to the court. In actual fact the cost is €610.00
Solicitors Firm Getting Nearly treble that amount - In one letter to a client from a solicitor legal fee + VAT €1,626
- This equates to over 2.66 times more that the client is being offered.
Considering, due to the incompetence and what seems to be gross negligence of the HSE people’s private data including their
- Ukranian Man Arrested in Cork for Conti involvement but never charged in Ireland.
Related legal actions include the extradition of a Ukrainian national (Oleksii Lytvynenko) from Ireland to the US in 2025, linked to the broader Conti operation. The Conti operation impacted over 1,000 victims and extorted at least $150 million globally before the group disbanded around 2022.
Landmark case in ransomware attacks
This remains a landmark case in ransomware attacks on critical infrastructure, underscoring risks to healthcare systems. For official details, refer to HSE resources or the National Cyber Security Centre (NCSC) Ireland reports.
Key Takeaways
- The Conti ransomware cyber attack on the Health Service Executive occurred on May 14, 2021, leading to numerous legal proceedings.
- The attack caused major disruptions to healthcare services and exposed sensitive patient data.
- HSE offered inadequate compensation, causing frustration among victims whose data was compromised.
- The case has become a landmark in addressing risks to critical infrastructure and healthcare systems.
- Nearly five years later, legal proceedings continue, with trial dates potentially delayed for another 18 months or more.
