> series: anatomy_of_a_breach —— part: 150 —— targets: irish_hse + jbs —— sectors: healthcare + food_supply —— ransomware: conti + revil<span class="cursor-blink">_</span>_
On 14 May 2021, Conti ransomware devastated Ireland's Health Service Executive (HSE) — the publicly funded healthcare system serving 5 million people. The attack encrypted systems across Ireland's hospitals and healthcare facilities, forcing cancellation of thousands of outpatient appointments, reverting hospitals to paper records, delaying cancer treatments, disabling diagnostic imaging systems, and disrupting COVID-19 vaccination appointments. The HSE refused to pay the ransom. Full recovery took over four months and cost an estimated €100 million.
Sixteen days later, on 30 May, REvil ransomware struck JBS — the world's largest meat processing company, responsible for approximately 20% of US beef slaughtering capacity. The attack forced closure of processing plants in the US, Canada, and Australia, triggering fears of food supply disruption and price increases. JBS paid $11 million in ransom to prevent further disruption. Two essential services — healthcare and food — both crippled by ransomware within two weeks, by two different ransomware-as-a-service (RaaS) operations. The ransomware epidemic against critical infrastructure had reached crisis proportions.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Irish HSE attack was the most severe ransomware incident to strike a national healthcare system since WannaCry hit the NHS in 2017 — and in many ways was worse, because it was targeted and deliberate rather than a worm spreading indiscriminately. The Conti operators specifically targeted the HSE and demanded a $20 million ransom. The Irish government refused to pay. The recovery, which took over four months, required rebuilding IT infrastructure across the entire health service.
Colonial Pipeline (fuel), the Irish HSE (healthcare), and JBS (food) — three critical infrastructure sectors hit by ransomware within three weeks of each other. The concentration of attacks against essential services in May-June 2021 demonstrated that the ransomware threat had escalated from a business risk to a national security crisis. For UK organisations operating in any critical sector, the controls are the same ones this series has advocated for thirteen years: Cyber Essentials, penetration testing, SOC in a Box, and incident response capability.
<a href="/cyber-essentials">Cyber Essentials</a> provides the baseline. <a href="/penetration-testing">Penetration testing</a> validates controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors 24/7. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> manages the crisis.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call