In May 2021, a ransomware group carried out a double extortion attack on the HSE – data was stolen, and files encrypted, that caused a catastrophic impact on the HSE’s ability to function. The multi-faceted response which included the HSE and private sector partners, the National Cyber Security Centre and the Defence Forces was impressive, and certainly re-enforced the idea that cyber is a team sport – and it’s important to understand what the other players are doing.
In the almost three years since the attack – what has changed? I think there have been three significant shifts – changes to defenders, changes to the threat, and changes to the environment as a result of digital transformation programmes.
Changes to Defenders
Looking at the changes to defences, and the EU has responded in the best way it knows how – regulation.
- NIS2 will regulate essential services including healthcare so they have to take appropriate security measures and notify relevant national authorities of serious incidents.
- The Cyber Resilience Act will impose standards on software and hardware sold within the EU. The EU’s Cyber Security Act, first put into force in 2019, continued to be strengthened.
There has also been a Government led change. The NCSC in Ireland has grown from 25 staff in 2021, to 62 at the end of last year. Capital funding for ICT and digital health has grown from €60 million in 2018 to €155 million in 2024.
Smarttech247 Group plc (LON:S247) is a multi-award-winning MDR (Managed Detection & Response) company and a market leader in Security Operations. Trusted by global organizations, their platform provides threat intelligence with managed detection and response to provide actionable insights, 24/7 threat detection, investigation, and response.
