This teaching case explores the transformation of Ireland’s national health provider, the Health Service Executive (HSE), following a major ransomware attack that disrupted healthcare services across more than 50 hospitals in 2021. Now, 4 years on from that event, this teaching case focuses on the aftermath and what the HSE has been doing since the attack to improve its cybersecurity posture: the paper examines how the organisation is working to embed cybersecurity-by-design and strengthen public trust in digital health systems through long-term reforms in governance, infrastructure, and organisational culture.
DattaP (2020) Digital transformation of the Italian public administration: a case study. Communications of the Association for Information Systems46: 252–272.
4.
DattaPM (2025) The case of four state-sponsored hacks: a WhoDunIt mystery. Journal of Information Technology Teaching Cases00: 20438869251376669. https://doi.org/10.1177/20438869251376669.
5.
DattaPActonT (2025) Promises and perils of generative AI in cybersecurity. MIS Quarterly Executive24(2): 5.
6.
DattaPWalkerLAmarilliF (2020) Digital transformation: learning from Italy’s public administration. Journal of Information Technology Teaching Cases10(2): 54–71.
HeYAliyuAEvansM, et al. (2021) Health care cybersecurity challenges and solutions under the climate of COVID-19: scoping review. Journal of Medical Internet Research23(4): e21747.
MashinchiMIActonTDattaPM (2024) When healthcare becomes sick: recovering from ransomware. Journal of Information Technology Teaching Cases. [Preprint].
NikiOSairaGArvindS, et al. (2022) Cyber-attacks are a permanent and substantial threat to health systems: education must reflect that. Digital Health8: 20552076221104665.
ScalcoAFlaniganDSimskeS (2021) Control systems cyber security reference architecture (RA) for critical infrastructure: Healthcare and hospital vertical example. Journal of Critical Infrastructure Policy2(2): 125–145.
