Summary
- Environment: Hospital laboratory information system and connected backups
- Operational impact: Digital laboratory records encrypted; HSE estimated 84,000 people affected
- Financial impact: €300,000 administrative fine imposed; court confirmation not recorded
- Record status: Developing record. Reviewed October 27, 2026; updated as evidence emerges.
What happened
Ransomware hit the laboratory information system at Midlands Regional Hospital Tullamore on November 14, 2018. The Irish Health Service Executive notified the Data Protection Commission two days later. The regulator’s full decision describes encryption of the system and connected backups, which could not restore the affected records. [3]
The DPC adopted its decision on June 10, 2026 and announced it on June 15. This hospital incident occurred years before the separate HSE attack in 2021. [2][3]
Impact
HSE initially estimated that 50,000 people were affected, revising that figure to approximately 84,000 on November 30, 2018. Records contained patient identifiers, contact information and clinical diagnostic results. [3]
Digital record access was disrupted. HSE maintained that patient care was not interrupted because paper records remained available; that does not mean the laboratory system remained operational. The forensic assessment considered large-scale theft unlikely but could not exclude selective viewing or extraction because the available information was incomplete. [3]
The DPC imposed a €300,000 administrative fine, a reprimand and compliance measures. Its fines register still listed court confirmation as “Not Confirmed” when reviewed on October 27. The fine is not a measure of total incident cost or evidence of payment. [1][3]
Timeline
Laboratory ransomware detected
Ransomware encrypted the laboratory system and backups.
[3]Regulator notified
HSE notified the DPC of the personal-data breach.
[3]Affected-person estimate revised
The estimate increased from 50,000 to approximately 84,000 people.
[3]Decision and administrative fine adopted
The DPC imposed a reprimand, compliance measures and a €300,000 fine.
[3]Decision publicly announced
The DPC announced its decision after notifying HSE on June 11.
[2]Briefing updated
This briefing was last reviewed and updated on October 27, 2026.
Threat Group & Attack Vector
The DPC found an internet-exposed Remote Desktop service and a weak administrator password. Access to the secondary database account enabled access to other devices. Missing intrusion detection and insufficient backup separation compounded the incident; connected backups were also encrypted. The forensic report identified a CrySIS ransomware variant. [3]
Actors
- No threat actor group has been identified in the reviewed public evidence. CrySIS identifies malware, not an attributed operator. [3]
TTPs
- T1486 — Data Encrypted for Impact: ransomware encrypted laboratory records and connected backups. [3]
Response
The hospital blocked its connection to the HSE network, disconnected servers, activated downtime procedures and notified hospital and general-practice users while planning restoration. [3]
The DPC’s decision imposed the fine for infringements of Articles 5(1)(f) and 32(1) and provided a right of appeal. The later register establishes the recorded confirmation status, not the outcome of an unreviewed appeal or payment process. [1][3]