Inquiry into Midlands Regional Hospital Tullamore

On the 10 June 2026 the Data Protection Commission adopted its final decision following an inquiry into a ransomware attack on the laboratory information system in Midlands Regional Hospital Tullamore, County Offaly. The breach was detected on 14 November 2018. The attackers gained access to computers that stored and processed laboratory results of patients’ diagnostic tests, and used that access to encrypt patients’ personal data. 

The DPC’s inquiry examined the HSE’s technical and organisational measures for ensuring the security of processing personal data on the systems that were attacked. It also examined the HSE’s compliance with the GDPR in relation to its contracts with service providers such as third-party data processors, its record of processing activities, and the requirement to notify persons who are affected by high-risk breaches. 

The DPC’s decision, which was notified to the HSE on 11 June 2026, finds that the HSE:

• infringed the principle of integrity and confidentiality of Article 5(1)(f) GDPR by failing to ensure appropriate security of the personal data related to the processing of patients’ personal data using appropriate technical and organisational measures;
• infringed Article 28 GDPR by not ensuring that agreements with third parties that processed personal data on its behalf included sufficient safeguards to ensure that processing was fully compliant with the GDPR and that the rights of data subjects were protected;
• Infringed Article 30 GDPR by failing to have a complete and compliant record of processing activity at the time of the breach;
• infringed Article 32(1) GDPR by failing to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by its processing of personal data on the systems affected by the ransomware attack; and
• infringed Article 34 GDPR by its failure to provide to persons affected by the breach all information required by that Article.

In light of the infringements identified above, the DPC has:

• reprimanded the HSE;
• fined the HSE €300,000 for the infringements of Articles 5(1)(f) and 32(1) GDPR; and
• ordered the HSE to implement specified policies and procedures intended to ensure appropriate security of processing of personal data.

You can download the full decision at this link: Inquiry concerning Midlands Regional Hospital Tullamore - June 2026 (PDF, 1.3MB)