Ireland’s HSE attack was decided in the eight weeks before encryption

The week

In the early hours of Friday, May 14, 2021, staff across Ireland’s hospitals found their computers no longer worked. The Conti ransomware group had encrypted systems across the Health Service Executive, the HSE, which runs the country’s public health services.

The HSE is a very large organization. The independent review published later that year described around 4,000 locations, 54 acute hospitals, more than 70,000 devices and over 130,000 staff, counting those employed by organizations it funds. It also runs the National Healthcare Network, which connects the HSE with statutory and voluntary hospitals. Many voluntary hospitals run their own IT but share that network.

Ransomware is malicious software that locks up an organization’s files by encrypting them, scrambling the data with a secret key so it is unreadable, and then demands payment for the key. Groups like Conti pick targets that cannot afford to stop working, and a national health service is about as clear an example as exists.

The ransomware ran at about 1 a.m. By 2:50 a.m., the HSE’s national service desk was receiving reports from hospitals of encrypted systems. By mid-morning, the HSE had decided to switch off all of its IT systems and disconnect from the national network as a precaution. It brought in the Garda National Cyber Crime Bureau, Interpol and Ireland’s National Cyber Security Centre. That afternoon, it sent a text message to all HSE work phones telling staff about the attack.

Hospitals across Ireland moved to paper. There was heavy disruption to outpatient services, diagnostics and radiology, the scans and imaging that so much modern care depends on. Clinicians who were used to pulling up a patient’s history on screen were working from handwritten notes and phone calls. Staff coordinated by mobile and landline phones, fax and face-to-face meetings. HSE management later told reviewers that about 80 percent of the environment had been encrypted. All of this came more than a year into the COVID-19 response, with the same organization running testing, tracing and vaccination.

The Department of Health, a separate body, had also been targeted. Its security provider raised an alert on May 13, and the department called in the National Cyber Security Centre and had endpoint detection tools installed on most of its systems. That blocked the ransomware across the vast majority of its infrastructure. The same attacker, in the same week, produced very different outcomes in two neighboring organizations.

The Irish government said it would not pay a ransom. Then, during the week of May 17, something unusual happened: the attackers provided a decryption tool, the software key that unscrambles the files, without payment. Reports of the handover emerged on May 20, and the review records the key as received on May 21. That might have ended the story, but recovery still took months, because systems had to be checked and rebuilt before reconnection. Once an intruder has had the run of a network, an organization cannot simply unlock the files and carry on. It has to be confident that nothing malicious has been left behind on each machine before plugging it back in.

The attackers had also taken copies of data, and they threatened to publish stolen patient data. They had posted samples on a dark web chat room on the day of the attack. Security professionals call this “double extortion”: lock the systems, then threaten a leak as well. In response, the HSE obtained a High Court injunction aimed at preventing its sharing or publication, a legal order directed at anyone who might pass the information on.

Ireland was not alone. On May 20, the FBI said it had identified at least 16 Conti ransomware attacks on US healthcare and first responder networks over the previous year. That same week, Waikato District Health Board in New Zealand was hit by a separate ransomware attack. Health care had become a favored target for groups that expected victims to pay quickly.

For a week in May, Ireland’s health service became a case study watched by hospital boards and health ministries everywhere. The more useful part of the case study came later.

The attack followed the pattern of a patient burglary. The intruder got into the building in mid-March, found an unwatched storeroom, and spent the next two months copying keys, learning where the valuables were kept and wandering from floor to floor at night. Alarms went off once or twice, but nobody came. Then, one Friday in May, the burglar changed every lock in the building and left a note asking for money.

The note is the moment everyone remembers. But the real damage was done in the two months before it.

The HSE attack is often remembered as the moment ransomware disrupted an entire national health system. The more instructive account came later. In December 2021, the HSE published an independent post-incident review prepared by PwC, and it moved attention from the day of the attack to the weeks before it. For health systems and the agencies that run them, the incident divides into three stages, each with distinct failures and fixes: entry, how the attackers got in; dwell, what happened between entry and encryption; and response, how the organization contained the damage and recovered.

That three-stage view is the most practical tool a non-technical leader can carry away from this incident. It replaces a single, frightening question (“could this happen to us?”) with three manageable ones that can each be measured and improved.

The article first explains how an attack of this kind unfolds, then takes the three stages in order. The later sections turn the stages into measures a leader can track, set out what the organization inherits when the stages go badly, and describe what a short-dwell organization looks like.

How a ransomware attack actually unfolds

What attackers like Conti were doing does not match the popular picture of a lone hacker breaking in and pressing a button.

Modern ransomware is closer to an organized burglary run as a business. First, someone gets a foothold: a single infected computer, often reached through a deceptive email. Next comes what security teams call lateral movement, the attacker hopping from that first computer to others on the same network, the way a burglar moves from room to room. Alongside it runs privilege escalation, obtaining more powerful accounts. An ordinary employee’s login can open a few files; an administrator’s login can change almost anything. The attacker’s goal is to collect the most powerful accounts in the organization, sometimes reaching the domain controllers, the central servers that decide who is allowed to log in to what. Owning those means controlling who can get in anywhere.

Only when the attacker is confident they can reach enough systems do they deploy the ransomware, usually all at once and often at night or on a weekend, to do as much damage as possible before anyone can react. They frequently copy sensitive data out first, which gives them a second form of pressure.

The tools that give the game away

Attackers rely on a small set of tools, and some are distinctive. Cobalt Strike is a commercial tool built for authorized security testing that criminals widely use in pirated form to control compromised machines. Mimikatz is a tool that extracts passwords and credentials from a computer’s memory. Both appeared in the HSE case.

Their value as signals is high. An ordinary workstation has no business running either. A detection of Cobalt Strike or Mimikatz is rarely a nuisance alert. It usually means a person is actively controlling a machine inside the network, and it should start an incident, not close a ticket.

The pace is uneven

Attacks do not proceed at a steady speed. The HSE review describes a burst of activity in March, then little significant activity from the start of April until early May, then a rapid escalation in the week before encryption. Lulls like that are common in ransomware operations. They make detection harder, because the window of loud activity can be short.

The encryption is the end of the attack, not the beginning. Everything that determines how bad the day will be happens earlier.

Entry: an ordinary beginning

According to the review, the attack began on March 18, 2021, with a malware infection on an HSE workstation whose user had opened a malicious Microsoft Excel file attached to a phishing email sent two days earlier. Malware is any software designed to do harm; phishing is the practice of sending a convincing but fake message to trick someone into opening a file or handing over a password. Five days later, the attacker set up a way to keep access even if the machine was restarted.

Initial access rarely gets more ordinary. No zero-day vulnerability or exotic supply chain compromise was involved. A zero-day is a flaw in software that the maker does not yet know about, so no fix exists; it is the kind of thing that makes headlines. None was needed here. An everyday spreadsheet and a plausible email were enough.

Why blaming the user misses the point

Blaming the user misses the design question. In a workforce the size of the HSE’s, someone will always open something they should not. Entry is the stage an organization controls least. Email filtering, blocking macros in files from the internet, attachment sandboxing and training all reduce the rate of successful entry. None eliminates it.

Those measures are worth a sentence each. Email filtering screens incoming messages for known threats. Macros are small programs embedded in documents such as spreadsheets; they are useful for automating tasks but are a favorite way to smuggle in malware, so many organizations now block macros in files that arrive from the internet. Attachment sandboxing opens a suspicious file in a sealed-off test environment first, to see whether it behaves badly before a person ever touches it. Training helps staff recognize the tricks.

The estate behind the inbox

Entry controls depend on the condition of the machines they protect. The review found the HSE had more than 30,000 Windows 7 workstations, an operating system its maker had stopped supporting. Unsupported systems cannot receive many of the newer protections that make a malicious attachment harder to run. Replacing them is slow and costly in a health service, because clinical applications and devices are often certified to run on a specific version.

The review also put the HSE’s IT spending in context. In a total budget of nearly €22 billion, it reported an IT operating budget of €82 million and an IT capital budget of €120 million. Together those were under one percent of total spending. Entry controls on a large estate are hard to fund at that level.

Entry by type of organization

The entry problem looks different across sectors. A bank typically has a centrally managed fleet of standard desktops, tight email controls and staff trained under regulatory expectations. Its weak points are more often third-party connections and remote access. A health system has clinicians on shared workstations, many contractors and students, and medical devices that cannot run modern protections. A county government may have dozens of departments with their own systems and small IT teams, plus elected offices that resist central control.

The response is the same in principle across all three. Reduce the ways a single opened file can run code, keep machines patched and supported, and assume that some entries will still succeed.

Security architecture has to assume some initial access will succeed, and make sure one compromised workstation does not lead quickly to everything else. Spending decisions start there too. Money aimed at preventing every entry yields diminishing returns once basic controls are in place. Leaders who measure their programs mainly by phishing click rates are measuring the stage that matters least to the final outcome.

Dwell: eight weeks of missed signals

“Dwell time” is the period an intruder spends inside a network before being discovered or before striking. The review found that the attacker operated inside the HSE environment for nearly eight weeks before deploying ransomware. In that time they moved across the network, compromised highly privileged accounts and reached a large number of systems, including servers in hospitals and the national network.

The signals, in order

There were signals. On March 31, the HSE’s antivirus software detected Cobalt Strike and Mimikatz on the first compromised workstation. It was set to monitor mode, so it detected but did not block the malicious activity. Nothing in the record shows that detection leading to an investigation.

The final week was dense with warnings. On May 7, the attacker began using highly privileged accounts and compromising further systems. Over the next five days, the review found evidence of compromise in hospital after hospital. On May 10, one hospital’s antivirus detected Cobalt Strike on two systems. The hospital asked its security provider whether to worry and was told the risk was low, because the antivirus had dealt with it. No incident investigation followed.

On May 12, another hospital engaged its incident response provider, reset passwords for about 4,500 accounts, changed firewall settings and asked the HSE about two suspicious addresses. The next day, the HSE traced those addresses to its own servers but concluded, wrongly, that the activity had come from the hospital rather than the other way round. Also on May 13, the HSE’s security provider emailed to say there had been unhandled threat events on at least 16 systems since May 7. The response was a request to restart servers.

The ransomware ran early the next morning.

Why the signals were missed

The review noted the HSE lacked a security operations function monitoring around the clock, meaning there was no dedicated team watching for and responding to alerts at all hours. It also found that the HSE had no chief information security officer and no single owner of cybersecurity risk. Alerts went to teams that did not treat them as signs of a human intruder.

One pattern recurs through the timeline: an alert counted as handled once the antivirus removed a file. Removing one file does not remove an attacker who has already used it to gain a foothold. Treating a Cobalt Strike detection as a cleaned-up malware event, rather than evidence of an operator at work, is a mistake many organizations made and still make.

The contrast with the Department of Health is the strongest evidence in the case. Faced with the same attacker on May 13, the department escalated at once, called in national help and deployed endpoint detection before the ransomware ran. Its systems were largely spared. The difference between the two outcomes was the response to the signals in the last days, not the strength of the front door.

The estate that made it easy

This is the decisive stage. Eight weeks is a long time. An organization that can detect lateral movement and privilege escalation, and respond within hours or days, turns a would-be national outage into a contained incident on a few machines. The HSE’s environment, as the review described it, made that very hard: a large, federated estate with many legacy systems, including unsupported operating systems, and a flat network with few barriers to movement.

A few of those words matter. “Federated” means many semi-independent parts, such as regions and hospitals, each with some of its own systems, joined together. “Legacy” systems are older technology still in use, and “unsupported” operating systems are ones the maker no longer updates with security fixes, so known weaknesses stay open. A “flat” network is one with few internal walls: once you are on it, you can reach most other parts of it.

The review added a further detail: a complex and unmapped set of permissions for system administrators across the national network. Administrator accounts that work everywhere are convenient for a stretched IT team. They are just as convenient for an attacker who steals one.

The investments that shorten dwell

The investments that shorten dwell are well known. Endpoint detection set to block, with people assigned to act on its alerts at any hour. Separate administrator accounts and tiered privileged access, so a stolen workstation login cannot reach domain controllers. Network segmentation between hospitals, regions and the national core. Each alert needs a named owner and a response time.

Segmentation means dividing a network into zones with controlled doorways between them, so that a problem in one zone cannot spread freely to the others. In a federated health system, segmentation is slow and costly, because shared networks and accounts also make clinical information sharing easy. Doctors in one hospital need to see test results from another. The HSE experience is the clearest public case for doing it anyway.

What a different May 10 would have looked like

The hospital that saw Cobalt Strike on May 10 had roughly three and a half days before encryption. A team treating that alert as an intruder, rather than as cleaned-up malware, would follow a familiar sequence. Isolate the two machines from the network but keep them running, so their memory can be examined. Identify the accounts used on them and disable or reset those with administrator rights. Search every other machine for the same tool and the same network connections. Tell the national team and the other hospitals on the shared network what was found.

Each step takes hours, not weeks, and none requires new technology. The second hospital did most of this on May 12 and limited the damage on its own systems. Had the national team received and acted on the same warning, the attacker’s final push might have been interrupted. Nobody can know that for certain, but the Department of Health’s experience suggests the window was real.

Contracts for watching

Most organizations below national scale will buy round-the-clock monitoring rather than build it. A managed detection and response provider can watch alerts at night for a regional bank, a mid-size hospital or a county. The contract decides whether that helps.

Three terms matter most. First, which detections automatically count as an incident, with Cobalt Strike, credential-theft tools and new administrator accounts on the list. Second, whether the provider may isolate a machine or disable an account on its own authority, or may only send an email. Third, who on the client side must answer at 3 a.m., and how fast. The hospital that was told its risk was low shows what happens when those terms are vague.

Federated structures beyond Ireland

The federated problem is not unique to a national health service. A US health system with affiliated hospitals and physician practices often shares networks and directories with organizations it does not fully control. A county may share a network with its courts, sheriff and elected clerks. Credit unions share core processing through service organizations. In each case, one member’s weak controls become everyone’s exposure.

The review’s answer was a “code of connection”: minimum security requirements for every party that connects to the shared network, with a way to check they are met. The same idea works for any shared environment. Connection becomes conditional on meeting the baseline, and the baseline includes monitoring.

Six hospitals, one bad night

Suppose a regional health network has six hospitals. On a Tuesday night, its endpoint software flags an unusual program running on a clerk’s computer in Hospital C and, because it is set to block, stops it. An on-call analyst gets the alert within minutes, sees that the same account then tried to log in to a server in Hospital E, and disables the account. Because Hospital C sits in its own network segment, the attacker cannot reach the central servers without passing through a monitored doorway. By Wednesday morning, two computers are being rebuilt, a handful of staff have reset passwords, and the executive team receives a short briefing. A short dwell time looks like this: a bad night for the security team, and an ordinary day for patients.

Response: shutting down a nation’s systems

When encryption began, the HSE shut down its national network. That limited further damage but meant recovery required re-establishing trust in every system before reconnection. Even with a working decryptor, restoration was slow because the attacker’s access had been so broad. Every server and endpoint needed checking.

The first days

The review’s account of the first days shows an organization improvising competently. A war room was set up in borrowed office space on May 15. Senior leaders were given clean email accounts so they could communicate outside the compromised environment. Incident response firms deployed monitoring software across the estate to see where the attacker had been. From May 17, daily coordination meetings brought together everyone supporting the response. The data protection regulator was informed on the evening of the attack.

Those steps were sensible, and many organizations would struggle to match them. But each had to be invented on the day. A pre-arranged command location, out-of-band communication tools and retained response firms would have saved hours when hours mattered most.

The long recovery

Recovery took most of the summer. The review reports that by September 21, all servers were considered decrypted and about 99 percent of applications restored, more than four months after the attack. The decryptor saved effort but did not save time on the slow part: checking each system for traces of the attacker before reconnecting it.

Preparation that was missing

The review also noted gaps in preparation for an event of this scale. Tested plans for a cyber incident affecting the whole organization were limited, and critical knowledge sat with a small number of people. Clinical services adapted with notable resilience, but largely through improvisation. Improvisation is admirable in a crisis, but it is not a plan; it depends on the right people being available, rested and in the room.

The review made a pointed observation. The parts of the health service best equipped to keep going were those that still relied on paper records. Digital maturity had made services more efficient and, without matching continuity planning, more fragile. The review accordingly recommended a clinical and services continuity program alongside the technology work.

The data track

Response also had a data track. The attackers held patient information and threatened to publish it, so the HSE had to pursue legal remedies, monitor for leaks, and prepare to notify the people affected while clinical recovery was still under way. The High Court injunction was an unusual step aimed at limiting onward sharing by legitimate platforms and media. It could not stop criminals, but it gave the organization a lever over the channels most likely to amplify a leak. A health system planning its response should decide in advance who leads this track and which legal options it would pursue.

The legal frame differs by jurisdiction. In Ireland, the GDPR governed notification to the data protection regulator and to individuals. A US health system would work under the HIPAA Breach Notification Rule and state laws. A US bank would face its regulators’ notification rules, which since 2022 have required notice to the primary federal regulator within 36 hours of determining that a qualifying computer-security incident has occurred. Each sets its own clock, and counsel should map them before an incident, not during one.

Three things to settle in advance

Response readiness has three parts that can be prepared in advance. Authority: who may disconnect a region or the national network, and on what criteria, without waiting for a meeting. Evidence: offline backups and a known-good inventory of systems, so the organization knows what to rebuild and in what order. Offline backups are copies stored where an attacker on the network cannot reach or delete them. Reconnection rules: what checks a hospital or service must pass before it rejoins the network.

Reconnection rules deserve more attention than they get. In a federated network, every member wants back on as soon as possible, and every member is a possible route for reinfection. A short checklist, agreed in advance, makes the decision consistent. It might require a clean scan by endpoint detection, reset privileged credentials, confirmed patching and a named person attesting that the checks were done.

Sequencing matters as well. The HSE had to decide which services to restore first while its partners were all asking at once. A prioritized list, agreed with clinical leaders in advance, settles the order: services that keep patients alive, then those that keep the system moving, then everything else. Without one, the loudest request tends to win.

Organizations that define these in calm conditions shorten recovery by weeks. Those that do not make the decisions under pressure, with incomplete information and the same few experts stretched across every site.

Three numbers a leader can actually track

Boards are often handed security dashboards full of figures that are easy to count and hard to interpret: emails blocked, patches applied, training modules completed. The three-stage view suggests a shorter and more revealing set of measures, one for each stage.

For entry: how much of the workforce is protected by the basic controls. The figure that matters is the share of computers where macros from the internet are blocked, where suspicious attachments are screened first, and where staff sign in with more than a password, rather than the click rate on a test email. These are yes-or-no facts about the environment, and they can be raised toward full coverage. The share of machines on supported operating systems belongs in the same figure.

For dwell: time to detect and time to contain. The first is the typical time between a warning sign appearing and a person looking at it; the second is the time between that person looking and the threat being stopped. A security team can measure these from its own records, and the trend over time says more about readiness than any single figure. Running regular exercises, in which a friendly team plays the attacker, produces realistic numbers rather than hopeful ones.

For response: time to restore a critical service from scratch. The measure is how long it actually takes to rebuild an important system from backups, tested, with the result written down, rather than whether backups exist. Many organizations discover in their first real test that the answer is days longer than anyone assumed.

Reporting the numbers to a board

A board does not need many figures, but it needs them consistently. A one-page quarterly report can show the three numbers, their trend over the last four quarters, the target for each, and the two or three projects meant to move them. A short note on the most serious incident of the quarter, described by stage, completes the page. Directors can then ask the right question for each stage: why coverage is not rising, why detection is slower, why the restore test took longer.

Making the numbers honest

Any metric can be gamed. Time to detect looks better if only easy alerts are counted. Restore times look better if the test uses a small system. The fix is to define the measures carefully and have someone independent check them. Internal audit can sample alerts and confirm the times. Exercises run by an outside team, using the techniques seen in real attacks such as the HSE’s, test whether the detection works at all.

Three numbers will not capture everything. But they keep the conversation on the stages that decide the outcome, and they make progress, or the lack of it, visible to people who do not read technical reports.

What a ministry inherits from an IT failure

Months of recovery, stolen patient data and a court injunction: that is what the HSE inherited from the attack.

Patients and customers. When systems went down, care was delayed and clinicians worked without their usual tools. In a bank or a government agency, the equivalent is customers who cannot pay, or citizens who cannot receive benefits.

Money. Recovery that takes months consumes staff time, outside specialists and replacement technology, and it diverts leaders from everything else. The review warned that the remediation program would likely cost a multiple of the HSE’s existing IT capital and operating spending over several years. The cost of shortening dwell time is modest by comparison.

Legal and regulatory exposure. Stolen personal data brings notification duties and legal action, as the injunction shows. Regulators increasingly ask whether an organization had reasonable controls in place, as well as whether it was attacked. The HSE was already designated an operator of essential services under the EU’s first network and information security directive, which carried security and incident reporting duties.

Governance. The review’s strategic recommendations were largely about structure: stronger board oversight of IT and cybersecurity, a chief technology and transformation officer with real authority, a chief information security officer, and a clinical continuity program. Those are decisions for boards and ministers, not for the IT department.

Reputation and staff. The HSE’s decision to publish a candid review strengthened its credibility. Meanwhile, the staff who carried services through on paper paid a real personal cost, and organizations depend on their goodwill.

The strongest objections

Two objections deserve an answer. The first is that blocking mode breaks things. Security tools set to block can stop legitimate clinical software, especially on older systems, and a hospital cannot afford that. The concern is real. It argues for testing and tuning blocking rules on legacy systems, and for blocking the most dangerous behaviors first, not for leaving a whole estate in monitor mode.

The second is that round-the-clock monitoring is beyond the means of small organizations. A rural hospital or a small county cannot staff a security operations center. It can, however, buy monitoring as a service, or share it through a regional or sector arrangement. The cost of that service is small next to months of recovery.

Short dwell by design

The better-prepared organization tracks how long it takes to notice and stop an intruder, rather than how many phishing emails it blocks. It has a team, in-house or contracted, watching alerts around the clock. Its security tools are set to block rather than merely record. Administrators use separate accounts for powerful tasks, and the network is divided so one hospital or branch cannot become a doorway to all the others. Leaders have rehearsed a full-scale outage at least once.

Who owns each stage

Each stage needs an owner. The chief information officer owns entry controls and the condition of the estate, including the plan to retire unsupported systems. The chief information security officer owns detection and containment, with the authority to isolate machines and disable accounts without waiting for approval. The chief executive and the clinical leadership own response, because disconnecting a hospital is a clinical decision as much as a technical one. The board owns the funding and the measures.

The first ninety days

An organization starting from a weak position can make real progress in a quarter. In the first month, list every security tool set to monitor only, and move the safest ones to blocking. Write the short list of detections that always open an incident. In the second month, separate administrator accounts from everyday accounts for the most powerful roles, and confirm who answers alerts at night. In the third, run one exercise in which a friendly team uses the tools seen in the HSE attack, and time the detection. The whole sequence can be done without a large purchase.

What the evidence looks like

An auditor or regulator testing the program would ask for evidence by stage. For entry, configuration reports showing macro blocking and supported systems. For dwell, alert records with timestamps, escalation logs and the results of exercises against realistic attack techniques. For response, the decision rights for disconnection, the reconnection checklist and the record of the last full restore test.

Where programs fail

The weaker ones repeat the same errors:

• Treating the user as the problem. Running ever more phishing training while the network behind the inbox remains wide open.
• Tools in watch-only mode. Buying good security software and leaving it set to observe, often to avoid disrupting legacy systems.
• Alerts without owners. Generating warnings that land in a shared mailbox nobody checks at night.
• Closing alerts when a file is removed. Treating a quarantined tool as the end of the matter, when it is evidence of an intruder.
• Single points of knowledge. Relying on two or three people who understand how everything connects.
• Plans never tested. Writing an incident plan for one system going down, never for everything going down at once.

Where the eight weeks would be won or lost

1. If an intruder got onto one clerk’s computer tonight, would we notice within hours or within eight weeks, and who would be woken up?
2. Are our security tools set to block threats, or only to report them? Where are they set to report only, and why?
3. If one site or business unit were compromised, what stops the attacker reaching all the others?
4. Who has the authority to disconnect part of the network, on what criteria, and do they know it?
5. Are our backups stored where an attacker on the network could not delete them, and when did we last restore from them?

Anyone can ask these without a technical background; the answers are useful only if they are honest. A sixth line of inquiry follows from the HSE timeline: whether an alert that names a known attacker tool opens an incident or merely closes a ticket.

With hindsight

The HSE review became one of the most cited public post-incident reports in healthcare cybersecurity, largely because it was published and was candid. Many organizations suffer serious attacks and say little about what went wrong. By putting its findings in public, the HSE gave every other health system a detailed map of how a ransomware attack grows from one opened attachment into a national outage.

Its most useful content was the timeline. Named dates for each missed signal, from the March 31 detection to the May 13 email about unhandled threats, made the dwell argument concrete in a way general advice never had. The contrast with the Department of Health, which stopped the same attacker by acting fast on May 13, became the case’s most persuasive evidence.

The HSE set out a multi-year cybersecurity transformation following the review, including stronger security leadership and monitoring. The shape of that response was right: sustained investment in the people and processes that catch intruders early, rather than a single purchase. The review itself had warned that the work would cost a multiple of existing IT spending over several years.

Conti did not last much longer as a brand. In early 2022, after the group publicly backed Russia’s invasion of Ukraine, a large cache of its internal chats was leaked. The group wound down that year, and its members dispersed to other ransomware operations. The techniques did not change much; the names did.

Some entry controls improved across the industry. In 2022, Microsoft began blocking macros by default in Office files downloaded from the internet, the kind of control discussed above. That narrowed one of the routes used against the HSE, without closing the broader problem of a single opened file.

In Europe, the NIS2 Directive, adopted in 2022, broadened cybersecurity obligations for healthcare providers and tightened incident reporting. European health organizations now face cybersecurity as a legal duty with reporting deadlines attached, rather than a matter of good practice alone. Member states had until October 2024 to write it into national law, and many were late.

The dwell pattern recurred. In the Change Healthcare attack of February 2024, UnitedHealth’s chief executive told Congress that criminals entered through a remote access portal without multi-factor authentication and deployed ransomware nine days later. A remote access portal is a doorway that lets staff reach internal systems from outside; multi-factor authentication would have required more than a password to pass through it. Different country, different organization, similar shape: an unremarkable way in, followed by days of undetected movement.

Candid public reviews also became more common. In March 2024, the British Library published a detailed account of the ransomware attack it suffered in October 2023, in a similar spirit. Those reports remain rarer than the attacks, but the HSE showed that publishing them builds credibility rather than destroying it.

What has not held up as well is the hope that dwell times would shrink on their own. Nine days at Change Healthcare is shorter than eight weeks at the HSE, but it was still long enough. Faster attackers mean the window for detection is narrower, which raises the bar for monitoring rather than lowering it.

The finding has held up: the size of a ransomware disaster is mostly settled before the ransom note appears, by whether anyone noticed the intruder in the days or weeks between entry and encryption. That shifts the question worth asking away from “how do we keep everyone out?”, which no organization can fully achieve, toward “how quickly would we notice someone who got in, and how far could they go before we did?”