---
title: "Ireland Employment Permits Portal incident"
description: "Ireland took its Employment Permits Portal offline after unauthorized activity; possible account-data exposure remains under investigation."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-02"
canonical_url: "https://www.ally.security/incidents/ireland-employment-permits-portal-incident-2026"
markdown_url: "https://www.ally.security/incidents/ireland-employment-permits-portal-incident-2026.md"
stix_url: "https://www.ally.security/incidents/ireland-employment-permits-portal-incident-2026/stix.json"
---

# Ireland Employment Permits Portal incident

The portal is offline while security checks continue, but internal permit processing remains available.

Last modified Nov 2, 2026 · 1 source

## Summary

- **Environment:** Ireland Employment Permits Portal
- **Operational impact:** Portal offline; internal permit processing continues
- **Financial impact:** No incident cost disclosed

## What happened

Ireland’s [Department of Enterprise, Tourism and Employment](https://enterprise.gov.ie/) took its Employment Permits Portal offline after identifying suspicious unauthorized activity and a security vulnerability. [1](#source-1)

## Impact

Potential exposure includes names, email addresses and account roles. The Department’s preliminary findings excluded broader sensitive-data categories; investigation continues. Internal permit processing and decision updates continue. [1](#source-1)

## Timeline

### October 29, 2026 — Portal incident disclosed

The Department published its [incident notice](https://enterprise.gov.ie/en/publications/employment-permits-portal-personal-data-security-incident.html). [1](#source-1)

### November 2, 2026 — Briefing updated

This briefing was last reviewed and updated on November 2, 2026.

## Threat Group & Attack Vector

The Department restricted administrator access and removed access from suspected compromised accounts. The precise vulnerability and entry path remain unspecified. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The Department added firewall restrictions, engaged independent specialists and notified the [Data Protection Commission](https://www.dataprotection.ie/). Its notice expects reopening November 3 after security measures and verification; restoration is not confirmed. [1](#source-1)

Users should verify unexpected permit-related requests through official contacts. The Department promised flexibility for application deadlines affected by the outage. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/ireland-employment-permits-portal-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Employment Permits Portal – Personal Data Security Incident

official · Department of Enterprise, Tourism and Employment · Oct 29, 2026

<https://enterprise.gov.ie/en/publications/employment-permits-portal-personal-data-security-incident.html>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: The Department advised users to beware of suspicious messages about permits, accounts or payments and to verify unexpected requests through established official contacts.
2. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: Department publishes portal incident notice
3. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: The preliminary investigation identified possible exposure of names, email addresses and account roles. The Department said broader sensitive personal-data categories had not been affected according to its preliminary findings.
4. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: The Department suspended new registrations, restricted administrative access, removed access from suspected compromised administrator accounts and added firewall restrictions.
5. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: Ireland’s Department of Enterprise, Tourism and Employment identified suspicious unauthorized activity and a security vulnerability in its Employment Permits Portal, which it took offline as a precaution.
6. **Disclosed At · 100% confidence · current**  
   Ireland Employment Permits Portal incident: 2026-10-29
7. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: Internal permit processing and decision updates continued. The Department said saved drafts, pending-payment applications and other information would remain available when the portal returned, with flexibility for affected deadlines.
8. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: The Department engaged independent cybersecurity specialists, began formal incident response and submitted an initial notification to the Data Protection Commission.
9. **Occurred At · 100% confidence · current**  
   Department publishes portal incident notice: 2026-10-29
10. **Resulted In · 100% confidence · current**  
   Ireland Employment Permits Portal incident: The notice expected reopening on November 3, 2026 after necessary security measures and independent verification; this was a forecast, not confirmation of restoration.
11. **Affected Organization · 100% confidence · current**  
   Ireland Employment Permits Portal incident: Department of Enterprise, Tourism and Employment

</details>