HSE Suspends Medical Card Issuance After Cyberattack on Printing Contractor

The Irish Health Service Executive (HSE) has halted the production of several physical health and benefit cards following a cyberattack on an external service provider, raising fresh concerns about…

The Irish Health Service Executive (HSE) has halted the production of several physical health and benefit cards following a cyberattack on an external service provider, raising fresh concerns about supply-chain vulnerabilities in critical public services.

The disruption, which took effect on July 10, 2026, affects the distribution of plastic medical cards, GP visit cards, drug payment scheme cards, long-term illness cards, and European Health Insurance Cards (EHIC). Health officials confirmed the attack targeted a card-printing vendor rather than the HSE's own infrastructure, which remains secure and uncompromised.

What Cards Are Affected

The pause covers all physical card types issued by the HSE, though the authority stressed that access to healthcare services remains unaffected. Patients who need proof of eligibility can use provisional certificates or the HSE Health App as alternatives. A dedicated contact line has also been set up for those with questions about their card status.

The HSE acknowledged that a small number of records were accessed during the breach of the third-party system. The matter has been reported to the Data Protection Commissioner.

Broader Cybersecurity Concerns

The incident comes at a time of heightened alert for Irish infrastructure. National Cyber Security Centre (NCSC) Director Richard Browne recently warned that ransomware remains the most significant threat to the state, noting that Ireland faced several major attacks in the weeks before it assumed the EU Presidency on July 1, 2026. The NCSC has been running drills to prepare for large-scale disruptions, citing regular cyber espionage activities from various international actors.

The breach also follows legal pressure from Brussels. On July 8, 2026, the European Commission referred Ireland — alongside Spain and France — to the Court of Justice of the European Union for failing to transpose the NIS2 Directive into national law. The directive aims to establish a high common level of cybersecurity across the union, particularly for critical infrastructure providers. While other member states such as the Netherlands have recently approved compliant legislation, Ireland does not expect to complete the transposition until the end of 2026.