Public procurement notice: Contract Award Notice
Published: 2021-07-09
Buyer: Health Service Executive (HSE)
Country: IE
Contract type: Services
Procedure: Negotiated without a prior call for competition
CPV classification: 50324000 | 50324100 | 72212730 | 72212732
Estimated value: 546138 EUR
Award criteria: Lowest price

Technical requirements: The OoCIO had an immediate requirement post cyber attack to plan, stage and perform the eviction of attackers from their known span of control to remove an imminent threat and return the HSE to an operational state.
In the early hours of 14 May 2021, the HSE became aware of a major cyber-attack against the HSE’s IT systems through the criminal infiltration of these systems using Conti Ransomware. As a result, all HSE IT systems were shut down. This event is thought to be the most serious cyber-attack on the country’s critical infrastructure and is considered by the HSE to be a Major Incident.Healthcare services across the country have been severely disrupted with real and immediate consequences for the thousands of people who require health services every day.Given the seriousness of this attack and the impact it had on those people who are dependent on health services, the Board of the HSE immediately began work on putting in place an effective cyber-security incident-response team (CSIRT). Clear roles and responsibility were established which enabled internal coordination and fostered a united approach. The CSIRT acted as the recognised point for external coordination. The process was designed with a focus on damage-limitation to the HSE’s services, its data assets, its network, and its application infrastructure.
In selecting a company to undertake the contract members of existing Framework Agreements were considered using the following criteria:
• plan, stage and perform the eviction of attackers from their known span of control to remove an imminent threat;
• provide a minimal level of protection and detection layers to help prevent a potential re-compromise;
• increase the likelihood of immediate detection should the attacker succeed in re-entering the environment based on the urgent need and criteria Microsoft were chosen to provide the service required as
HSE used the negotiated procedure without prior publication in accordance with Article 32(2)(c) of Directive 2014/24/EU to award this contract. The HSE is satisfied the tests permitting use of the negotiated procedure without prior publication (Article 32(2)(c)) were met, as set out below.
The Authority was responding to the Cyber-attack immediately because of public health risks presenting a genuine emergency.
The extent of the Conti Ransomware attack is thought to be the most serious cyber-attack on the country’s critical infrastructure. The level of impairment on hospitals, and other health institutions to provide treatment, could, certainly, not be foreseen and planned in advance, and thus constitute an unforeseeable event for the contracting authorities.
It cannot be doubted that the immediate needs of the hospitals and health institutions to have their ICT systems effectively restored had to be met with all possible speed. It was judged to be a situation of extreme urgency making compliance with general deadlines impossible. Procurement following the usual timescales under Directive 2014/24/EU, including accelerated options, was impossible in this case as these timescales would not meet the public health needs and would put lives at risk.
As documented above, the Conti Ransomware attack is the most serious cyber-attack on the country’s critical infrastructure and presented a serious risk to human life. The HSE acted proportionately and without delay in its response to this most serious cyber-attack.


Winner: Microsoft Ireland Operations Ltd
Award value: 546138
Number of bids: 1