Russians crippled HSE after 'hacking into just one laptop', says cyber security head

Richard Browne of the National Cyber Security Centre told the Dáil transport committee the cyber attackers were based in Russia.

He told TDs the hackers had infiltrated the HSE systems through the laptop of a staff member.

However, he said the movement of the attackers across the systems should have been caught earlier.

"It's an extremely serious example of what can go wrong in ransomware incidents," Mr Browne said.

"It, of course, and this is nearly always the case, could have been prevented."

He said it has now been resolved and explained how the entire HSE system was targeted through the laptop of a staff member, which was compromised for seven weeks before the attack.

Eight days before the attack, the hackers then were able to gain access and "explore" the HSE network.

"They started extracting a relatively limited amount of data out of the HSE network through a number of different links, not just the laptop," Mr Browne said.

"Initial access was through a single device. What should have been caught was the migration of the actor across the entire network."

Chair of the committee Fine Gael TD Kieran O'Donnell said the entire HSE system had been compromised through a single laptop.

He said "significant steps" have been taken by the HSE to improve security since then.

Mr Browne also told the committee how the "threat of cyber espionage" was high now. However, he said there is currently no evidence of anybody looking to launch a cyber attack against the State and he said the State would be able to defend itself in such a scenario.

However, he admitted Russia's war in Ukraine does pose a higher threat of a cyber attack.

As well as military attacks, Russia has launched cyber attacks on Ukraine.

Here, the State's cyber security centre currently employs about 70 staff. Mr Browne said he hoped to increase this number "significantly".