Ireland

This page covers cyber threats to Ireland. It brings together official Irish texts (the National Cyber Security Centre, the Data Protection Commission, the Comptroller and Auditor General, the Health Service Executive and the Irish Statute Book), and Brandefense research. Where an official source says something about Ireland, the page says who said it and when.

Threat groups that official sources link to Ireland

No threat group that has a profile in our library is named by the official Irish sources opened for this page as a group that targeted Ireland. The NCSC said on 14 May 2021 that the attack on the Health Service Executive (HSE) was likely by criminal actors, and on 16 May 2021 that initial reports indicated a human-operated Conti ransomware attack. It did not name the operators. In June 2026 the NCSC wrote that sophisticated state directed hacking groups target sensitive data held by other governments, but the pages opened do not name any group as a threat to Ireland.

Incidents on record

The incidents listed below are major ones only. They have national impact and are described in official sources.

How attackers target Ireland: Brandefense research

Dark web, stolen data and ransomware. Our report Ireland Cybersecurity Threat Landscape 2025 describes a threat picture shaped by dark web activity, stolen financial data, exposed credentials and ransomware. The report states that mentions of Ireland on underground platforms exceeded 340,000 per month in mid-2025, that credit card data theft rose from 4,500 in 2024 to over 60,000 in 2025, and that over 49 ransomware attacks were confirmed. It states that telecommunications and energy are the most targeted sectors for credential exposure.

Ransomware groups. Our profile post WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations says Conti led to hundreds of attacks in different countries, including the attack on the Irish Health Service Executive in 2021. The official Irish sources opened name Conti as the ransomware used, but do not name the group behind it.

Regulation and supply chain. Our article NIS2 and DORA Compliance: What They Require for Third-Party Risk Management refers to survey data showing that 38% of Irish businesses would not be compliant by October 2024.

How Brandefense helps

Brandefense gives security teams in Ireland a view of threats outside their own network. Cyber Threat Intelligence tracks the ransomware and state-aligned activity that Irish bodies describe. Dark Web Monitoring looks for stolen credentials and leaked data tied to your organization. Phishing Monitoring finds fake sites and emails that copy your brand, the same entry route the HSE review describes for the 2021 attack. Brandefense works with teams in Ireland through its partner Renaissance. No service removes risk, but earlier warning gives teams more time to act.

Law and national strategy

The National Cyber Security Strategy was published in December 2019 and follows a first strategy of 2015. Its objectives include improving the State’s ability to respond to and manage cyber security incidents, protecting critical national infrastructure and making sure operators of essential services have incident response plans, and improving the resilience and security of public sector IT systems (NCSC strategy page).

The NCSC NIS2 page, last updated 2 April 2025, says the transposition deadline for the NIS2 Directive of 17 October 2024 had not been met, and that the earlier NIS1 rules remain in full effect for the most critical operators. The status of the legislation may have moved since; check the NCSC site.

The Criminal Justice (Offences Relating to Information Systems) Act 2017 creates offenses such as accessing an information system without lawful authority, interfering with data and intercepting transmissions. The Data Protection Act 2018 established the Data Protection Commission and gives further effect to the GDPR.

How incident response is organized

The NCSC was founded in 2011 and, according to its current website, is an operational arm of the Department of Justice, Home Affairs and Migration. NCSC alerts of May 2021 and the Comptroller and Auditor General describe it as part of the Department of the Environment, Climate and Communications, so sources differ by date. Its main roles include leading the management of major cyber security incidents across government. It includes the national incident response team, CSIRT-IE, which acts as a national point of contact for all cyber security matters concerning Ireland. During the 2021 HSE attack the NCSC activated its crisis response procedures, and Gardai worked with international law enforcement on the investigation (HSE).

In June 2026 the NCSC said that Ireland holds the Presidency of the Council of the European Union from July to December 2026 and that it considers five categories of threat: financially motivated attacks, espionage, hacktivism, destructive attacks and influence operations. It names ransomware as the most impactful financially motivated attack.

Sectors and rating

The 2025 National Cyber Risk Assessment lists the critical sectors as energy, health, digital, banking, transport, public administration and water. It says ransomware remains one of the top cyber threats facing EU member states, and the NCSC page on the assessment names increasingly sophisticated nation-state activity and the accelerating pace of cybercrime.

Personal data

The Data Protection Commission is the national independent authority for the right of individuals in the EU to have their personal data protected, and the Irish supervisory authority for the GDPR. The HSE reported the 2021 breach to it on 15 May 2021 (Comptroller and Auditor General). On 10 June 2026 the DPC adopted a final decision on a separate ransomware attack, detected in November 2018, on a hospital laboratory system. It reprimanded the HSE and fined it 300,000 euro.

The official sources opened name no attack counts for Ireland. Figures will come from Brandefense Atlas.