{
  "type": "bundle",
  "id": "bundle--ae16e093-818b-5372-86d6-2da7766d3375",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--00485cde-db24-5b2f-8468-8588f3a34f3c",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:89cd5fb3-7346-5dc6-90dc-1a2b2cb8f22b",
      "name": "Ireland HSE",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--2f288ad8-027a-5efa-8795-5a44e7fd2751",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "brh:3e45da58-968f-46b0-aa86-cd1eba4e7c0a",
      "name": "Midlands Regional Hospital Tullamore laboratory ransomware incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "inc:b9e4acdc-2100-44c0-bfa6-482eec489e6d",
      "name": "Midlands Regional Hospital Tullamore laboratory ransomware incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a7842bb-e172-513c-83ad-cff8489be78d",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:1d26b00f-8e31-4f7c-bd97-3adaeeaf3d26",
      "relationship_type": "affected-organization",
      "source_ref": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "target_ref": "identity--00485cde-db24-5b2f-8468-8588f3a34f3c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:2a97121a-6dbf-4b1c-99ed-87f8748215bb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62bbc3cc-0f60-5fee-88a8-4002d61ea0bc",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:56ea7670-4343-43e6-bacd-2d04c23d47e2",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "target_ref": "x-ally-event--1f996b33-45e6-512b-8f24-d879d197301f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:dbaf5196-4634-4cf4-bd35-08c32c9a6ab7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83998f41-6d15-5c5a-8c2b-54a33346f25f",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:b92e7684-b9ab-4076-a678-48be29f99f7f",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "target_ref": "x-ally-event--dee97a31-496c-5b92-8e64-9f0300b053c2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-final-decision-midlands-regional-hospital-tullamore-inquiry",
          "external_id": "cit:0da736d2-76db-47bb-8af0-d3c39dd9a553",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:11bb7c94b2a27c3ba0a4115d6617f80f00f6a00cade4f83cd0170a5829c3517b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d90d01-ff00-5c01-8a79-807876302c91",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:08fc5e18-a58a-4ca2-b8ce-10397bf0d106",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "target_ref": "x-ally-event--d6d59c06-bfc4-505d-8206-2505a25a89ac",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:d0f810e2-5c7b-4aa0-b936-0dd46cf8a8f6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3830e53-414f-5acc-85ca-d9fd78a086ab",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:bf56df1d-19b8-4479-b3b1-65b4aa1d22aa",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "target_ref": "x-ally-event--92ff25cd-8bd0-5ce4-8460-71b00d80bb70",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:2738a97d-54f3-4e68-8a63-86404cb69d7c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fedafeae-d3f6-5c77-8649-d14f91e3d2f2",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:3ef94b34-6a34-4a44-a7f9-9d10c915771e",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f8cec35d-0cd2-5385-8564-9e1c937b6f13",
      "target_ref": "x-ally-event--84058a8e-5c50-5736-8d83-8ab6ddaa8c55",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:d208c2aa-1fb6-4cc7-9677-ab7b2ddfa4cb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0d39a74f-eab7-559d-8477-1eabf13466ae",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:40ac6ae4-76ae-40fe-8a36-5ea1a7e332a5",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0dac5e95-0a47-5d8d-8154-d332d21c6c94",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:35f234e6-695f-4de2-93c2-3a01196f3f01",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:c316e641-21c5-4e49-9d9f-133dd522d90f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2018-11-30"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--134e294a-f4c5-5e65-8aca-6427cf59c3c0",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:3219aa3b-4dcb-451e-b8a9-33568499aba1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:3b742ffc-a431-4e82-b0fd-d4a04238e860",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The forensic assessment considered large-scale data theft unlikely but could not rule out selective extraction or viewing because information was incomplete."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2be697d3-a57a-51d7-8c85-9ce871d82a02",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:b163f2a8-102d-4cf7-b7c2-34bb72fd4f07",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:b9852200-fd16-4813-94fc-635225dabd86",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2018-11-16"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--305cb29e-1535-5b64-87d7-c2f13d67c46b",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:3f54707c-4114-424f-8f64-d6fc5e9295a7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:c98a1789-16f9-4f7f-a5d7-2ae3949ae813",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2018-11-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3210b7e2-f8ad-5ae6-80f6-9046041462b7",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:c0d0f4fd-f05a-4407-9ea9-41f8aec93d20",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:b83a99c5-2d1e-4bfb-897d-530693160da6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Affected records contained patient identifiers, contact information and clinical diagnostic results. HSE initially estimated 50,000 people affected, then revised the estimate to 84,000 on November 30, 2018."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3b7deb40-f9c2-50a0-8ac8-67ebf508267d",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:080e732d-0a27-43c2-b0c4-5bc61e848b65",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:02ad0de4-5040-4328-b270-85047416aeef",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2018-11-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3d6f12c5-51dc-5a91-8dd8-f40582a94fc1",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:ecef8baf-132b-48a8-9e7a-4a0ff9e3b925",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:b99f8dc3-7e94-414b-ba2f-7c4962dc0479",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 84000,
        "approximate": true
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--45402ad7-482a-53ab-874d-a7140f3c7ed2",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:5e85c4ff-6b48-4690-bd60-be65946a686d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:659c0ba0-23e4-42fa-a606-92dc2063d503",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2018-11-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4d8fc762-2043-51da-816b-571f02ca79be",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:4f767987-ab87-40a2-988c-d3de5697f67b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-final-decision-midlands-regional-hospital-tullamore-inquiry",
          "external_id": "cit:f8a1e09b-add3-47db-a5f2-ea16762ceba0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:11bb7c94b2a27c3ba0a4115d6617f80f00f6a00cade4f83cd0170a5829c3517b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-06-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--577ffa59-a40d-5369-80a9-3210dd43225e",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:a7b229c1-5d5d-4582-a782-8d5b27aed30a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-final-decision-midlands-regional-hospital-tullamore-inquiry",
          "external_id": "cit:67b0b503-315e-4172-8bda-f3aaa1196f4f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:11bb7c94b2a27c3ba0a4115d6617f80f00f6a00cade4f83cd0170a5829c3517b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The DPC announced the decision on June 15, 2026 after notifying HSE on June 11."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--644acfbc-c623-5139-8bd2-c36a07ea3df9",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:a3707598-2535-4c01-8e1f-41e03354e7aa",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:a50b0a9c-c169-49e9-a4cb-462fd55823bb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The hospital blocked the connection to the HSE network, disconnected servers, activated downtime procedures and notified hospital and general-practice users while planning restoration."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8bdc9145-2031-5210-8971-1df4599e787b",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:b029dc4e-c2c3-4537-808b-ebf7061db23f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:6bc29a96-566e-46a8-aea2-d678a671acbc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The DPC found internet-exposed Remote Desktop access, a weak administrator password, missing intrusion detection and insufficient backup separation. The compromised secondary database account enabled access to other devices."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--962848a1-c023-5801-83dc-3868172ae6b8",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:5e392aaf-99af-4d70-910d-4f53a99e2e1c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:63c82894-fa33-40f0-ba3d-6ab36a050c0a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-06-10"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--abce104c-7cc2-5ea0-88f9-992fb80682e7",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:539efb88-a446-455c-8b4d-b84a2becc1b8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:9825590d-ca7c-4b41-9ddf-37445ef0ba9e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "HSE maintained that patient care was not interrupted because paper records were available. Digital access and record availability were affected; that statement does not mean the laboratory system remained usable."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b8af70e8-72b8-5af8-84e2-ad04126943ba",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:cfafe261-f7f9-4a06-b030-785ade30fbb6",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:ca5ff31b-87b4-43b1-b55a-9a037782c4b2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The DPC adopted its decision on June 10, 2026, reprimanded HSE, ordered compliance measures and imposed a EUR 300,000 administrative fine for infringements of Articles 5(1)(f) and 32(1). The decision provided a right of appeal."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--beda631e-5923-558a-8c03-f6d17529f154",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:7e23362d-b357-4042-98fd-ba16918e2161",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf",
          "external_id": "cit:ef450f76-a051-41d2-be52-4cad2148c448",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:932af4b4e524fcbbc496feaf2e3f976a787208978699627046d7bb0f4152da63"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On November 14, 2018, ransomware encrypted the hospital laboratory information system and connected backups. A subsequent forensic report identified a CrySIS variant; records could not be recovered from those backups."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--da31bad8-4279-5ae3-8abd-30f28c1e6c47",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "clm:0d394334-8042-48c4-b125-f6329b2cb778",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Data Protection Commission",
          "url": "https://dataprotection.ie/en/dpc-guidance/decisions/fines",
          "external_id": "cit:c68d61f1-5d61-4d7b-8008-6655578ec859",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:3484da88febc6ee92ae979bddacc4446ec5503b88b43cf4d5f5d3026b7cff1b1"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "At retrieval on October 27, 2026, the DPC fines register listed IN-19-9-4 at EUR 300,000 with court-confirmation status Not Confirmed. This does not establish that the fine was paid."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--1f996b33-45e6-512b-8f24-d879d197301f",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "evt:b66c8e1f-b090-4304-b191-e1f43658f433",
      "name": "Laboratory ransomware incident detected"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--84058a8e-5c50-5736-8d83-8ab6ddaa8c55",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "evt:30d974d9-cfcb-45f5-9065-415f197e1470",
      "name": "DPC adopts decision and administrative fine"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--92ff25cd-8bd0-5ce4-8460-71b00d80bb70",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "evt:31be8021-63b1-42f5-977c-dddcec8f223c",
      "name": "DPC notified"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--d6d59c06-bfc4-505d-8206-2505a25a89ac",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "evt:2278dcfb-bbd4-411c-a3ed-208466475894",
      "name": "Affected-person estimate revised"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--dee97a31-496c-5b92-8e64-9f0300b053c2",
      "created": "2026-10-27T14:17:41.239837+00:00",
      "modified": "2026-10-27T14:17:41.239837+00:00",
      "x_ally_original_id": "evt:a6c6b2d0-f7e3-4f45-ab99-f64fa2dbfefb",
      "name": "DPC announces decision"
    }
  ]
}