Cyber attacks: a household plan for Ireland

Check what the affected service says you need to do. Keep appointments unless its current instructions say otherwise, and expect changes where records or booking systems are unavailable.[2] If you have been scammed, contact your bank immediately and report it to Gardaí.[11]

The scene this guide is for

Your hospital appointment is tomorrow. The news reports a cyber attack, and a text arrives asking you to confirm your details through a link. Meanwhile, a family member cannot open their banking app.

Deal with each problem separately: check the appointment, verify the message independently, and ask the bank about its service. For the history of the HSE’s 2021 attack, read When national systems fail.[1]

When a service you rely on is hit

Check the organisation’s own website or app, reached independently. For healthcare, use HSE and your hospital or clinic’s current notices. If unsure, ring a number from an existing letter, statement or bank card. Do not use contact details supplied by a suspicious message.[2][4][5]

Use this household checklist to establish what still works. These are questions to ask, not predictions that every attack stops every service.

Keep appointments unless told otherwise, including through an official notice covering your clinic or procedure. Do not wait for a personal call if the service has published a cancellation. Tallaght’s dated attack notice illustrates why: some scheduled care continued while radiology appointments were cancelled. Use today’s instructions for today’s appointment.[2]

Keep essential documents and contacts on paper. The Irish preparedness checklist includes emergency contacts, medical information, cash and cards.[3] See Phones and internet down for communications fallbacks and Cash and payments for a modest reserve and payment alternatives.

Watch for scams using the attack as a story

FraudSMART warns that criminals can exploit news of an attack with fake calls, texts and emails claiming to be a bank or another service provider. Knowing your name, address or part of your card number does not prove a caller is genuine.[4]

1. Stop before responding. Do not open unexpected links or attachments asking you to restore access or confirm details.[4][5]
2. Keep secrets private. Never give passwords, PINs, one-time security codes or card details to an unexpected caller or message sender.[6][12]
3. Check through a number you already have. Hang up and ring the organisation using your genuine statement, appointment letter or bank card. Avoid the number supplied in the message. If the call came to your landline, use another phone, or wait until you hear a dial tone before dialling: a caller can keep the line open.[4][8][11][14]
4. Refuse unexpected remote help. Do not let a caller take control of your device or persuade you to download software.[5][8]

ComReg warns that displayed phone numbers can be faked. A familiar-looking number is not proof either.[5]

If your data may have been taken

Ask the organisation whether you are affected and exactly which information was involved. Follow its verified advice, change affected passwords and change them anywhere you reused them. Watch account activity and contact your bank about exposed financial details or unfamiliar transactions.[8]

Under the GDPR, an organisation must inform affected people without undue delay where a breach is likely to create a high risk to their rights and freedoms. The DPC describes exceptions, including effective encryption or measures removing that high risk; where individual contact involves disproportionate effort, equally effective public communication is required.[7]

The notice must explain the breach in clear language, give a contact for further information, describe likely consequences and explain measures taken or proposed to address it.[7]

Four jobs for your own accounts and devices

Start with email and banking, then work through the other accounts you would struggle to lose. The DPC highlights email because access to it can put other accounts at risk.[8]

1. Install updates. Keep phone, computer and app software current, using official sources.[9]
2. Use a different strong password for each important account. NCSC’s plain-English guide explains passwords, passphrases and password managers.[6]
3. Turn on two-step verification. Look for two-factor authentication or MFA in account security settings. It adds another check when you sign in. Never share its codes.[6]
4. Keep an offline backup of photos and documents. Copy important files to separate storage, disconnect it afterwards and store it securely. Try recovering a file so you know the copy works. This applies NCSC’s separate-backup guidance to a household.[10]

Cloud storage alone is not the same as a recoverable backup. Business readers should use the small-business backup section for records needed to resume trading.[10]

If you have been scammed or hacked

1. Contact your bank at once if money or banking details are involved. Explain what you shared or paid. Ask about protecting the account, replacing cards and whether a payment can be stopped or reversed.[4][11]
2. Report the crime to your local Garda station. This is the reporting route published by the Garda National Cyber Crime Bureau.[9]
3. Keep evidence. Save messages, emails, screenshots, dates, amounts and transaction references. Do not delete scam correspondence before reporting it. Collecting evidence should not delay the bank call.[11][12]
4. If you installed software or gave a caller remote access, disconnect that device from the internet and switch it off, then call your bank at once from another phone. Recover accounts from a different, trusted device and get trusted help before using the affected one again.[13]
5. Recover affected accounts. Change compromised passwords and contact the service provider if you cannot regain access. Stop contact with anyone threatening to disclose your data and report threats to Gardaí.[8][12]

Booklet material used: emergency contacts, documents, medical information, cash and cards, rewritten from the Irish preparedness checklist.[3]