Thursday 5 November 2026Compiled from published reports. Every claim links to its source.

Ireland Crime

Every case followed from the first report to the sentence, or to where the reporting stopped.

Case No. 30190Cybercrime (ransomware attack)

Gardaí plan to target gang's finances in HSE ransomware attack case

In May 2021 the HSE was hit by a significant ransomware attack that forced it to shut down all its IT systems. The attack is linked to a gang believed to be Russian-based or Russian-speaking, known as Conti or Wizard Spider, and no suspect is named in the reports. On 5 September 2021 the Garda National Cyber Crime Bureau, working with Europol and Interpol, seized domains, websites and servers used in the attacks. On 7 September 2021 gardaí said they plan to target the gang's finances, and the investigation into those responsible is ongoing.

  1. Reported5 Sep
  2. Arrested
  3. Charged
  4. In court
  5. Verdict
  6. Sentenced
reportedhappened, not reportedlatest stagenot yet

Key facts

consolidated from all reports
When
The HSE was hit by a significant ransomware attack in May 2021 and was forced to shut down all of its IT systems.
Other details
  • The gang behind the attack is believed to be Russian-based or Russian-speaking and is known as Conti or Wizard Spider.
  • Gardaí say the seizure prevented more than 750 extortion attempts, as 753 attempts were made by ICT systems worldwide to connect to the seized domains.
  • The HSE says more than 95 per cent of its systems have been restored, but the attack continues to affect X-ray and radiotherapy areas.
  • Russia does not extradite its citizens as a matter of policy.
Cause
The group sent phishing emails with attached links, and clicking a link could install malware on a computer and the wider IT system.
Weapon
The group used ransomware to access data stored on central servers, and stolen information was used to blackmail victims for large sums.
Where
The servers used by the group are located in various countries around the world, and none of the bank accounts targeted are based in Ireland.
Investigation
  • The Garda National Cyber Crime Bureau led an international operation, with Europol and Interpol, that seized websites, domain names and servers used in the attacks.
  • Visitors to the seized domains see a Garda splash screen warning that their systems may have been compromised by ransomware.
  • Gardaí plan to target the gang's finances next by freezing bank accounts used to funnel money from victims.
  • The investigation into the HSE attack and the people responsible is ongoing, and the articles report no arrests or charges.
43 statements extracted from the articles
  • whatWeb domains used by the group to send phishing emails and upload ransomware were taken down by law enforcement. (irishtimes.com)
  • whereThe servers located by gardaí are in various countries around the world. (rte.ie)
  • whereNone of the bank accounts targeted are based in Ireland. (irishtimes.com)
  • whenThe HSE was hit with a significant ransomware attack in May 2021 and was forced to shut down all of its IT systems. (rte.ie)
  • whenThe ransomware attack on the HSE occurred in May 2021. (thejournal.ie)
  • whenThe HSE ransomware attack was a major incident in May 2021. (irishtimes.com)
  • investigationThe Garda National Cyber Crime Bureau seized several domains used in the HSE cyber attack and other ransomware attacks. (rte.ie)
  • investigationAn Garda Síochána is working with Europol and Interpol to provide details of the URLs to member countries so infected systems can be decontaminated. (rte.ie)
  • investigationThe investigation into the HSE attack and finding those responsible is ongoing. (rte.ie)
  • investigationThe Garda National Cyber Crime Bureau conducted a significant disruption operation targeting the IT infrastructure of a cyber crime group. (thejournal.ie)
  • investigationThe GNCCB seized several domains used in the HSE attack and other ransomware attacks. (thejournal.ie)
  • investigationGardaí are working with other police agencies as part of the wider operation. (thejournal.ie)
  • investigationA process commenced between Garda Síochána and Europol and Interpol to provide details of visiting URLs to member countries for decontamination. (thejournal.ie)
  • investigationGardaí seized cyber infrastructure used by the gang involved in the HSE cyber attack after an international operation. (irishtimes.com)
  • investigationThe operation targeted websites, domain names and servers used in the attacks. (irishtimes.com)
  • investigationThe operation was led by An Garda Síochána and involved Interpol and Europol. (irishtimes.com)
  • investigationThe operation was run by the Garda National Cyber Crime Bureau. (irishtimes.com)
  • investigationDet Insp Brian Halligan said the GNCCB was making steady progress in its investigation into the HSE cyber criminals. (irishtimes.com)
  • investigationGardaí seized cyber infrastructure from the gang behind the HSE cyber attack (irishmirror.ie)
  • investigationThe international operation targeted websites, domain names and servers used in the cyber attacks (irishmirror.ie)
  • investigationThe garda operation was focused on infrastructure used to access and steal information in the HSE cyber attack (irishmirror.ie)
  • investigationGardaí plan to target the finances of the cybercriminal gang as the next stage of the investigation. (irishtimes.com)
  • investigationThe GNCCB led a successful international operation to seize the online infrastructure used to target the health service. (irishtimes.com)
  • investigationThe domain seizure operation prevented more than 750 extortion attempts. (irishtimes.com)
  • investigationThe next stage involves freezing bank accounts used by the cybercriminals to funnel money from victims. (irishtimes.com)
  • otherThe seizure has directly prevented a large number of further ransomware attacks across the world. (rte.ie)
  • otherThe ransomware attack was focused on accessing data stored on central servers. (rte.ie)
  • other753 attempts to access the infected domains have been made, and the Bureau believes its actions prevented a conti ransomware attack in each case. (rte.ie)
  • otherA total of 753 attempts were made by ICT systems across the world to connect to the seized domains. (thejournal.ie, irishtimes.com)
  • otherThe operation is believed to have prevented more than 750 ransomware attacks. (irishtimes.com)
  • otherThe gang is believed to be a Russian-speaking gang or hackers using their infrastructure. (irishtimes.com)
  • otherThe seizure is believed to have prevented over 750 more attacks (irishmirror.ie)
  • other753 attempts were made by ICT systems across the world to connect to the seized domains (irishmirror.ie)
  • otherThe seizure is likely to have prevented a ransomware attack on each connecting ICT system (irishmirror.ie)
  • otherThe seized IT infrastructure will be shared internationally to combat further attacks (irishmirror.ie)
  • otherThe infrastructure is used to send phishing emails to victims asking them to click on an attached link (irishmirror.ie)
  • otherBy clicking the link, hackers can install malware onto the computer and into the wider IT system (irishmirror.ie)
  • otherStolen information is usually used as leverage to blackmail victims for huge sums of money (irishmirror.ie)
  • otherThe infrastructure is now under the control of the Garda and other law enforcement agencies (irishmirror.ie)
  • otherThe cybercriminal gang is believed to be Russian-based or Russian-speaking. (irishtimes.com)
  • otherThe HSE says more than 95 per cent of its systems have been restored. (irishtimes.com)
  • otherThe attack continues to impact X-rays and radiotherapy areas. (irishtimes.com)
  • otherRussia does not extradite its citizens as a matter of policy. (irishtimes.com)

The reporting

newest first
  1. 7 Sep2021
    Otheririshtimes.com, follow-up
    Garda to target financial assets of HSE cyber attackers

    Reports the next stage of the HSE ransomware investigation: targeting the cybercriminals' financial resources by freezing bank accounts and examining legal proceedings for asset confiscation, after a prior operation seized the group's web domains.

    suspect
  2. 5 Sep2021
    Otheririshmirror.ie, its first report
    Gardai seize infrastructure from gang behind HSE cyber attack

    Reports the seizure of cyber infrastructure (websites, domain names, servers) by the GNCCB investigation team in an international crime-prevention operation, believed to have prevented 753 further ransomware attacks.

  3. 5 Sep2021
    Otheririshtimes.com, its first report
    Gardaí seize infrastructure from HSE cyber attack gang

    Reports on the seizure of the HSE attack gang's cyber infrastructure (websites, domain names, servers) and the ongoing GNCCB investigation into the May 2021 HSE ransomware attack.

  4. 5 Sep2021
    Otherthejournal.ie, its first report
    Garda operation targets gang behind HSE cyber attack

    Reports on the GNCCB disruption operation targeting the Conti cyber crime group, including seizure of domains, collaboration with Europol and Interpol, and 753 connection attempts to the seized domains.

  5. 5 Sep2021
    Reportedrte.ie, first report
    IT infrastructure of crime group 'disrupted' by gardaí

    Reports on the seizure of domains by the Garda National Cyber Crime Bureau as part of the ongoing HSE ransomware attack investigation, with international cooperation from Europol and Interpol.