Cyber-attacks against healthcare organisations are now happening every day. Large hospitals, health technology companies, pharmacies, and small healthcare providers have all been affected in recent years.

In one widely reported healthcare cyber incident, a major healthcare technology provider was attacked, which disrupted prescription processing across parts of the healthcare system for several days. Pharmacies were unable to process prescriptions during the outage, showing how a cyber incident in one part of the healthcare system can quickly affect patient care elsewhere.

In another case, a large retail pharmacy chain experienced a breach in which tens of thousands of customer account passwords were exposed.

A major North American pharmacy group was also forced to close all of its stores for more than a week following a cyber-attack while investigators assessed the damage. The incident required months of forensic investigation and the involvement of specialist cybersecurity teams, costing millions to resolve.

Regulators are also reporting an increasing number of data protection incidents involving pharmacies. In the UK, the Information Commissioner’s Office reported dozens of pharmacy-related data breach investigations over a short period, with significant fines issued where data protection rules were not followed.

What is striking about many of these cases is that they did not involve highly sophisticated attacks. Instead, they often began with simple mistakes or gaps in basic cybersecurity practices.

Common examples include:

• Paperwork or records being lost or left in insecure locations;
• Personal data being sent to the wrong recipient;
• Using CC instead of BCC when emailing multiple people;
• Emails containing personal data being sent to the wrong address;
• Verbal disclosure of personal data to the wrong person; and
• Staff clicking on malicious links in emails.

In a recent healthcare sector incident, attackers reportedly gained access to systems after an administrator clicked a link in a phishing email. The result was that hundreds of thousands of systems had to be taken offline.

The lesson from these incidents is clear: Cybersecurity is not just an IT issue — it is a patient safety and business continuity issue.

Community pharmacies hold highly sensitive personal and health data. They are also essential healthcare providers in their communities. A serious cyber incident could affect dispensing systems, patient records, communications with other healthcare professionals, and day-to-day pharmacy operations.

The good news is that many of the most effective cybersecurity protections are practical and achievable.

Many of the most serious cybersecurity incidents begin with relatively simple issues such as weak passwords, outdated software, unsecured devices, or staff being tricked by phishing emails. Addressing these fundamentals can significantly reduce the likelihood of a cyber incident affecting your pharmacy.

For community pharmacies, some of the most important areas to focus on include:

• Ensuring accounts are protected with strong passwords and two-factor authentication;
• Keeping pharmacy systems and computers updated;
• Maintaining reliable backups of important data;
• Ensuring staff understand how to recognise suspicious emails;
• Clearly identifying who is responsible for managing cybersecurity in the pharmacy; and
• Having a simple plan for what to do if something goes wrong.

None of these measures are particularly complicated, but together they form a strong foundation for protecting patient data, pharmacy systems, and the day-to-day operation of the business.

Guidance and resources

To support community pharmacies, the IPU has developed guidance and resources on cybersecurity and data protection, including practical advice on protecting pharmacy systems, managing patient data safely, and reducing cyber risk.

Pharmacies can access these resources at ipu.ie/cybersecurity.

The IPU also works with specialist cybersecurity advisors BH Consulting, who provide expert guidance on cybersecurity and NIS2 compliance for healthcare organisations.

Cyber-attacks are becoming more frequent across the healthcare sector. Taking steps now to strengthen cybersecurity can help protect your pharmacy, your patients, and your business.

For guidance and practical supports, visit ipu.ie/cybersecurity or bhconsulting.com.