HSE hackers cut off communication link by second week in June, court told

Hackers who attacked the HSE IT system and planted a ransomware note on it had cut off contact by the second week in June, the High Court has heard.

Mr Justice Senan Allen was told it is believed the link through which the hackers communicated was disabled and they had “deliberately locked themselves out”.

In their ransomware note last May, the hackers had stated they could be contacted via an electronic link provided.

A copy of the High Court order made last May against “persons unknown” responsible for the hacking on May 14th preventing them from selling, processing, publishing, sharing or making available to any member of the public, the stolen HSE data, which included private medical data of HSE patients, was successfully uploaded on to the hackers IT link.

The orders also restrained possession, transfer or disclosure of the information obtained from the HSE’s system without the HSE’s consent and require the “persons unknown” to identify themselves by providing names, postal addresses and email addresses.

The orders were sought in intended proceedings by the HSE which include claims for damages for breach of confidential information, fraud and deceit, conspiracy and conversion of the data which is believed to have been accessed by hackers based in Russia.

The intended defendants had 42 days to enter an appearance to the proceedings, after which the matter would return before the court.

When the matter came back before the court on Thursday, Jonathan Newman SC, for the HSE, said those who hacked into the HSE system had not identified themselves and their names are not known. “Communication has been cut off ,’ he said.

The court heard a copy of the High Court’s May order was successfully served and uploaded to the link but on June 11th the link was no longer accepting uploads.

The link was the only way of communicating with the hackers, counsel said. The defendant “persons unknown” had deliberately cut themselves off and it was not possible to serve a notice of motion on them concerning the case coming back before the court.

In continuing the May order, Mr Justice Allen noted the order was uploaded on to the link provided by the hackers and, because the link was later shut down, they were not on notice of the application before the court.

While the court would ordinarily be extremely reluctant to do anything when notice is not given, this case was different, he said.

He was satisfied the May order is valuable and ought to continue notwithstanding the hacker’ non-compliance.

Continuing the order, he said the defendants know from the order served it is open to them to apply to the court seeking discharge of it.