Health Service Executive (HSE) – €300,000 Fine (Ireland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Ireland’s DPC fined the HSE EUR 300,000 after a ransomware attack disrupted a hospital laboratory system and its backups. The decision found inadequate security, issued a reprimand and ordered compliance.
What happened
Attackers entered a hospital laboratory system through an unsecured port and weak administrator password. Ransomware also affected connected backups and made records unavailable.
Who was affected
People whose personal data were processed in the Laboratory Information System at Midland Regional Hospital Tullamore.
What the authority found
The DPC imposed a EUR 300,000 fine for breaches of GDPR Articles 5(1)(f) and 32(1). It also reprimanded processor-arrangement, processing-record and breach-communication failures under Articles 28, 30 and 34, without an additional fine.
Why this matters
Protecting health data includes preserving availability and recoverability. Backups exposed to the same attack can fail when they are most needed.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 14 August 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPC’s signed decision IN-19-9-4 dated 10 June 2026 imposed a EUR 300,000 fine on the Health Service Executive for inadequate security under GDPR Articles 5(1)(f) and 32(1), alongside a reprimand and compliance order. The case concerns the 14 November 2018 ransomware attack on the Laboratory Information System at Midland Regional Hospital Tullamore. An unsecured firewall port, a weak administrator password and connected backup systems contributed to the attack and loss of availability. Large-scale exfiltration was considered unlikely, but selective extraction could not be ruled out. The fine is expressly imposed in paragraphs 297 and 307; this is not a non-monetary violation-only decision. Its signed date, 10 June 2026, takes precedence over the 5 August date appearing in the PDF filename. This differs from the later EUR 645,000 HSE case about paper healthcare records. The reprimand also addresses infringements of Articles 28(1), 28(3), 28(9), 30(1) and 34 GDPR concerning processor arrangements, records of processing and breach communication; paragraph 277 expressly treats a reprimand as sufficient for those findings without an additional fine.
Related Enforcement Actions (1)
Other enforcement actions involving Health Service Executive (HSE) in IE
Details
About this data
Cite as: Cookie Fines. Health Service Executive (HSE) - Ireland (2026). Retrieved from cookiefines.eu
Last updated: