--- title: "Midlands Regional Hospital Tullamore laboratory ransomware incident" description: "Ransomware disrupted Tullamore hospital laboratory records in 2018; Ireland’s DPC imposed a €300,000 fine in its 2026 decision." incident_type: "Ransomware" status: "active" last_modified: "2026-10-27" canonical_url: "https://www.ally.security/incidents/tullamore-hospital-laboratory-ransomware-2018" markdown_url: "https://www.ally.security/incidents/tullamore-hospital-laboratory-ransomware-2018.md" stix_url: "https://www.ally.security/incidents/tullamore-hospital-laboratory-ransomware-2018/stix.json" --- # Midlands Regional Hospital Tullamore laboratory ransomware incident An exposed remote-access service, weak credentials and connected backups contributed to the laboratory ransomware incident. Last modified Oct 27, 2026 · 3 sources ## Summary - **Environment:** Hospital laboratory information system and connected backups - **Operational impact:** Digital laboratory records encrypted; HSE estimated 84,000 people affected - **Financial impact:** €300,000 administrative fine imposed; court confirmation not recorded ## What happened Ransomware hit the laboratory information system at Midlands Regional Hospital Tullamore on November 14, 2018. The [Irish Health Service Executive](https://www.hse.ie/) notified the [Data Protection Commission](https://dataprotection.ie/) two days later. The regulator's [full decision](https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf) describes encryption of the system and connected backups, which could not restore the affected records. [3](#source-3) The DPC adopted its decision on June 10, 2026 and [announced it on June 15](https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-final-decision-midlands-regional-hospital-tullamore-inquiry). This hospital incident occurred years before the separate HSE attack in 2021. [2](#source-2) [3](#source-3) ## Impact HSE initially estimated that 50,000 people were affected, revising that figure to approximately 84,000 on November 30, 2018. Records contained patient identifiers, contact information and clinical diagnostic results. [3](#source-3) Digital record access was disrupted. HSE maintained that patient care was not interrupted because paper records remained available; that does not mean the laboratory system remained operational. The forensic assessment considered large-scale theft unlikely but could not exclude selective viewing or extraction because the available information was incomplete. [3](#source-3) The DPC imposed a €300,000 administrative fine, a reprimand and compliance measures. Its [fines register](https://dataprotection.ie/en/dpc-guidance/decisions/fines) still listed court confirmation as “Not Confirmed” when reviewed on October 27. The fine is not a measure of total incident cost or evidence of payment. [1](#source-1) [3](#source-3) ## Timeline ### November 14, 2018 — Laboratory ransomware detected Ransomware encrypted the laboratory system and backups. [3](#source-3) ### November 16, 2018 — Regulator notified HSE notified the DPC of the personal-data breach. [3](#source-3) ### November 30, 2018 — Affected-person estimate revised The estimate increased from 50,000 to approximately 84,000 people. [3](#source-3) ### June 10, 2026 — Decision and administrative fine adopted The DPC imposed a reprimand, compliance measures and a €300,000 fine. [3](#source-3) ### June 15, 2026 — Decision publicly announced The DPC announced its decision after notifying HSE on June 11. [2](#source-2) ### October 27, 2026 — Briefing updated This briefing was last reviewed and updated on October 27, 2026. ## Threat Group & Attack Vector The DPC found an internet-exposed Remote Desktop service and a weak administrator password. Access to the secondary database account enabled access to other devices. Missing intrusion detection and insufficient backup separation compounded the incident; connected backups were also encrypted. The forensic report identified a CrySIS ransomware variant. [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. CrySIS identifies malware, not an attributed operator. [3](#source-3) ### TTPs - [T1486 — Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/): ransomware encrypted laboratory records and connected backups. [3](#source-3) ## Response The hospital blocked its connection to the HSE network, disconnected servers, activated downtime procedures and notified hospital and general-practice users while planning restoration. [3](#source-3) The DPC's decision imposed the fine for infringements of Articles 5(1)(f) and 32(1) and provided a right of appeal. The later register establishes the recorded confirmation status, not the outcome of an unreviewed appeal or payment process. [1](#source-1) [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Fines regulatory · Data Protection Commission ### Data Protection Commission announces final decision in Midlands Regional Hospital Tullamore inquiry regulatory · Data Protection Commission · Jun 15, 2026 ### Decision IN-19-9-4: Midlands Regional Hospital Tullamore regulatory · Data Protection Commission · Jun 10, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** Laboratory ransomware incident detected: 2018-11-14 2. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: Affected-person estimate revised 3. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: At retrieval on October 27, 2026, the DPC fines register listed IN-19-9-4 at EUR 300,000 with court-confirmation status Not Confirmed. This does not establish that the fine was paid. 4. **Affected Organization · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: Ireland HSE 5. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: The forensic assessment considered large-scale data theft unlikely but could not rule out selective extraction or viewing because information was incomplete. 6. **Occurred At · 100% confidence · current** Affected-person estimate revised: 2018-11-30 7. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: DPC adopts decision and administrative fine 8. **Discovered At · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: 2018-11-14 9. **Used Attack Technique · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: https://attack.mitre.org/techniques/T1486/ 10. **Occurred At · 100% confidence · current** DPC announces decision: 2026-06-15 11. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: HSE maintained that patient care was not interrupted because paper records were available. Digital access and record availability were affected; that statement does not mean the laboratory system remained usable. 12. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: Laboratory ransomware incident detected 13. **Occurred At · 100% confidence · current** DPC adopts decision and administrative fine: 2026-06-10 14. **Occurred At · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: 2018-11-14 15. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: On November 14, 2018, ransomware encrypted the hospital laboratory information system and connected backups. A subsequent forensic report identified a CrySIS variant; records could not be recovered from those backups. 16. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: The hospital blocked the connection to the HSE network, disconnected servers, activated downtime procedures and notified hospital and general-practice users while planning restoration. 17. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: The DPC announced the decision on June 15, 2026 after notifying HSE on June 11. 18. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: The DPC found internet-exposed Remote Desktop access, a weak administrator password, missing intrusion detection and insufficient backup separation. The compromised secondary database account enabled access to other devices. 19. **Occurred At · 100% confidence · current** DPC notified: 2018-11-16 20. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: DPC announces decision 21. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: DPC notified 22. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: Affected records contained patient identifiers, contact information and clinical diagnostic results. HSE initially estimated 50,000 people affected, then revised the estimate to 84,000 on November 30, 2018. 23. **Resulted In · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: The DPC adopted its decision on June 10, 2026, reprimanded HSE, ordered compliance measures and imposed a EUR 300,000 administrative fine for infringements of Articles 5(1)(f) and 32(1). The decision provided a right of appeal. 24. **Affected Individual Count · 100% confidence · current** Midlands Regional Hospital Tullamore laboratory ransomware incident: 84,000