In May 2021, a ransomware attack against the Irish Health Service Executive (HSE) disrupted Irish healthcare IT networks and hospitals for over 10 days, causing real-world consequences to patients and their families. Some stolen patient data was also published online. The HSE, which provides health and social care services in Ireland, shut down national and regional networks the same day to contain the incident. Malicious cyber activity was also detected on the Irish Department of Health (DoH) network however due to the deployment of tools during the investigation process an attempt to execute ransomware was detected and stopped. The attack also had an impact on Northern Ireland, affecting the ability to access data held by HSE for some cross-border patient services. Importantly, no ransom payment was made in either case. Law enforcement do not encourage, endorse, nor condone the payment of ransom demands. If you do pay the ransom: • there is no guarantee that you will get access to your data or computer • your computer will still be infected • you will be paying criminal groups • you’re more likely to be targeted in the future The NCSC publish guidance on how to defend organisations against malware or ransomware attacks, including how to prepare for an incident and steps to take if your organisation is already infected. States exploiting strategic vulnerabilities and supply chains The compromise of the software company SolarWinds and the exploitation of Microsoft Exchange Servers highlighted the threat from supply chain attacks. These sophisticated attacks, which saw actors target less-secure elements such as managed service providers or commercial software platforms - in the supply chain of economic, government and national security institutions were two of the most serious cyber intrusions ever observed by the NCSC. In early December 2020, a US cyber security firm, FireEye, found that an attacker had been able to add a malicious modification to a product that they and many other organisations around the world utilise. This modification allowed the attacker to send administrator-level commands to any affected installation of that product and could be used for further targeted attacks on connected systems. The initial supply chain attack was conducted through a piece of software called Orion, an IT network monitoring tool developed by a company called SolarWinds. The actor was able to implant malicious code into an update file for the software, as far back as March 2020. In April 2021 the NCSC, together with its security counterparts in the US, revealed for the first time that Russia’s Foreign Intelligence Service (the SVR) was behind this attack – one of the most serious cyber intrusions of recent times.15 SolarWinds confirmed 18,000 organisations across the world FCDO, Russia: UK and US expose global campaign of malign activity by Russian intelligence services (2021) 15 27