HSE cyber attack: One year on

Anniversaries give us a chance to reflect. And with a year since the Irish Health Service Executive (HSE) cyber attack, we take a look at the recovery, what’s happened since, and what can be done to address the cyber security skills gap.

How did the HSE’s ransomware recovery go? 

There are many parties involved in the data recovery of a large organisation. From the National Cyber Security Centre and the army through to IT Security specialists like Ekco, who have worked with several Irish hospitals for some time. 

Pat Larkin, co-founder of Ward Solutions, speaking about the recovery on Cork’s Red Fm, said that since the HSE was already on alert due to COVID, their crisis management response was good. They were already plugged into all the external parties they needed to liaise with. Even with a good response, appointments and surgeries were cancelled, diagnoses were missed, and a year later, the recovery is still ongoing. 

The risk of attack has increased since May 2021 

“There’s been a lot of water under the bridge since then,” Pat said on Neil Prendeville’s show on Red FM, “in terms of the HSE recovery, but also a change in the geopolitical situation. There’s a range of ramifications for cyber security in Ireland.” 

Organisations like the HSE that are involved in critical infrastructure are more at risk at times of unrest. But they aren’t the only targets, so the ongoing conflict in Ukraine means an increased risk for all companies across Europe.  

Back in March, three of our security specialists shared their thoughts on the increased cyber security risk that war brings, which you can check out here.  

What have we learned?

“The HSE attack was a wake-up call for Ireland,” Pat explains, “Neutrality, at that time, didn’t protect us at all. We must take national and cyber security seriously.” Pat has called for further investment in cyber security in Ireland for some time and has presented at two Oireachtas committees on the matter. 

Politicians are formulating responses in support of Pat’s efforts, but he feels change needs to happen faster, adding “The idea that you can keep these guys out is a fallacy”. 

This won’t come as a shock to anyone working in IT, with so many headlines and articles out there covering the threat of ransomware. Governments worldwide saw a 1,885% increase in ransomware attacks, and the health care industry faced a 755% increase in those attacks in 2021, according to the 2022 Cyber Threat Report released recently by SonicWall. 

The challenge here is making sure the threat is understood by non-technical stakeholders too. Our recent Infrastructure Modernisation Report, which surveyed over 700 IT Leaders, found that only 16% of C-Suite leadership have a good handle on cyber security. If they don’t fully understand it, how can they budget or resource IT accordingly?  

The IT skills gap in action 

RTE – Ireland’s Public Broadcaster – recently reported that the HSE is finding it difficult to recruit cyber security staff due to talent competition. 

An independent review by PwC found that before the attack, the HSE was operating on a frail IT system, and did not have proper cyber expertise or resources. Despite a recruitment drive, a tight labour market is making it tricky to hire the right talent.  

The skills gap is a challenge faced by our entire industry, which came up on our recent panel discussion on rethinking IT security strategies. 

During the event, Hylton Stewart, Information Security Manager at Ekco, said that companies need to combat the skills gap by thinking longer-term and hiring grads: “Look for people that are just coming out with no experience and train them.”  

Given the challenges around recruitment and retention in the security space, many organisations choose to partner with specialist MSSPs that can support with cyber security services, so that they can focus on their core business. 

Once upon a time, IT security could be handled comfortably in-house, as the rate of change was much slower. Today, IT teams have their work cut out – IT environments change daily, while the threat landscape is more complex, and the volume of attacks continues to rise. 

If you’re unsure how secure you are or you feel you need more robust protection, get in touch with our friendly team today. We’re here to give impartial, technology-agnostic advice to help you operate securely.