Cyber security

Phishing attacks are becoming more sophisticated, especially with the use of AI tools that generate convincing, well‑written emails.

Phishing messages - 5 tactics

Phishing messages often rely on 5 persuasive tactics designed to make you act before you think:

• authority - pretending to be a senior manager or official source
• urgency - claiming something must be done immediately
• emotion - creating fear, sympathy, panic or curiosity
• scarcity - suggesting a limited‑time opportunity
• current events - referencing tax deadlines, seasonal events or news stories

If any of these tactics appear in an email, treat it with caution. Verify the sender using an independent method such as a phone call or direct website visit.

Text message phishing is a cyber attack using a disguised text message. The text message may look genuine but is actually sent by cyber attackers trying to access systems. We tend to click on links in text messages more quickly than in emails. You should be extra vigilant when opening links in text messages.

Some phishing attacks involve taking over a legitimate email account. This is known as business email compromise (BEC). These attacks can be convincing because they come from a real email address. They may also reference genuine invoices, dates or account details. Follow HSE third‑party verification procedures before changing supplier bank details or processing unusual financial requests, even if the email seems genuine.

Warning signs

• Do you know the sender of the email or text?
• Were you expecting the email or text - is this a normal form of communication or does something seem unusual?
• Does the email address display correctly? For example, first.second@hse.ie is legitimate but first.second@hse-ie.com is not. Check the email address by hovering your mouse over the ‘from’ address
• Does the email or text create a sense of urgency or suggest something that seems too good to be true?
• Is there bad grammar and spelling?
• Is the email or text advising you to do something urgently? For example, for financial gain or a request for action so you don't lose a service?
• Does the email or text have links to click on for next steps?
• Is there an attachment on the email? Make sure the file is a recognised Word, Excel, PDF file that you would usually expect

Cybercriminals sometimes use QR codes to direct people to fake websites that steal login details or install malicious software.

These websites trick users into disclosing sensitive information such as login details, or asking them to download malicious files. This type of threat can lead to data theft and be a route for ransomware delivery.

Be cautious of emails from unknown or unexpected sources containing a QR code.

If you receive a suspicious email, you should:

• avoid clicking or scanning QR codes with your mobile device
• contact the sender through a trusted communication channel to verify the request is legitimate
• report it to the National Service Desk (NSD)

If you have accidentally scanned a QR code in a suspicious email, you should:

• disconnect your device immediately from the network (VPN, LAN or mobile tethering)
• avoid shutting down or turning off your device
• contact the National Service Desk immediately on 0818 300 300

Ask yourself:

• does the email have any of the characteristics listed on this page
• was I expecting this email
• do I know the sender? If you do then phone them to confirm the validity of the email

If you suspect the email is a phishing email:

• don’t click on a link or open any attachment
• delete it immediately

If you click on a link or open an attachment in a phishing email call the National Service Desk immediately on 0818 300 300.

Use unique passwords

Cyber criminals frequently take passwords stolen from one breach and attempt to use them to access accounts elsewhere. This technique is known as credential stuffing. Using the same password across multiple accounts makes this attack much easier.

Use unique passwords for HSE systems. Never reuse passwords from personal accounts. Enabling multi‑factor authentication on personal services adds an extra layer of protection if a password is compromised.

Keep passwords safe

Keep your passwords confidential. Don’t share them with others, including co-workers or third parties. Never write them down on or near your computer devices. If you suspect that your password is known by others, you must change it immediately. Change default passwords at installation. Make sure you only use accounts and passwords which have been assigned to you.

Find more information on data protection policies and procedures.