Sunday 1 November 2026Compiled from published reports. Every claim links to its source.

Ireland Crime

Every case followed from the first report to the sentence, or to where the reporting stopped.

Case No. 22302Cyber attack (data breach)

Tusla to contact 20,000 people affected by 2021 HSE cyber attack

Tusla is to begin contacting 20,000 people whose personal information was stolen during the 2021 cyber attack on the Health Service Executive, with the notification process expected to take until November 2023 to complete.

  1. Reported
  2. Arrested
  3. Charged
  4. In court
  5. Verdict
  6. Sentenced
reportedhappened, not reportedlatest stagenot yet

Key facts

consolidated from all reports
10 statements extracted from the articles
  • what20,000 people had personal information stolen in the 2021 HSE cyber attack (rte.ie)
  • whatPersonal information of people involved with Tusla services and a small number of employees was illegally accessed and copied (rte.ie)
  • whatStolen information includes referrals, reports, correspondence, names, addresses, phone numbers, and staff leave and travel expense details (rte.ie)
  • whenThe cyber attack on the HSE occurred in 2021 (rte.ie)
  • whenThe notification process is expected to take until November 2023 to complete (rte.ie)
  • investigationThe agency was assisted by the Garda National Cyber Crime Bureau, Interpol, and the National Cyber Security Centre (rte.ie)
  • investigationAn Garda Síochána provided Tusla with a copy of the illegally accessed files at the end of December 2021 (rte.ie)
  • courtA High Court order was secured restraining sharing, processing, selling, or publishing of the stolen data (rte.ie)
  • otherThere is currently no evidence the stolen information has been published on the dark web (rte.ie)
  • otherTusla commenced a €13m investment in cyber-security infrastructure the previous year (rte.ie)

The reporting

newest first
  1. 20 Feb2023
    Otherrte.ie, follow-up
    Tusla says 20,000 people had personal info stolen

    Tusla announces it will begin contacting 20,000 people whose personal data was stolen in the 2021 HSE cyber attack, with notifications expected to continue until November 2023. A High Court order restrains publication of the stolen data, and the agency has invested €13m in cyber-security infrastructure.