Organisation information
Cybersecurity Incident: Your Questions
From Office of the Protected Disclosures Commissioner (OPDC)
Published on
Last updated on
From Office of the Protected Disclosures Commissioner (OPDC)
Published on
Last updated on
Note: This page is being actively updated to reflect latest information. This page was first published on 17 December, 2025, and was updated on 19 December, 22 December, 6 January and 19 January.
Q. What happened?
On Thursday 11 December 2025 we were the subject of a random cybersecurity attack on some of our IT systems.
As a precaution, some systems were initially taken offline to contain the threat while the incident was investigated. However all systems are now back online.
Q. Has my data been taken?
Based on extensive investigations, including forensic investigations, and all the information currently available to us, we are confident that no personal data was taken. Our priority is to continue to protect people’s personal data.
Q. What action has been taken to protect my data?
Once we became aware of the incident our priority was to protect the data of people who rely on the services of the Office of the Protected Disclosures Commissioner and to restore services safely.
The NCSC (National Cyber Security Centre) activated its incident response plan and put in place enhanced monitoring to support the Office of the Protected Disclosures Commissioner.
The incident was also notified to the Data Protection Commissioner and An Garda Síochána.
We are now confident that no personal data was taken. However, at an early stage, an injunction was secured from the High Court prohibiting any publication of data.
For general guidance relating to data protection, please see the Data Protection Commission website . For general advice relating to the cyber security, please see the National Cyber Security Centre website . For queries relating to Office of the Protected Disclosures Commissioner’s data protection, see our Privacy notice .
Q. What services are impacted?
As a result of this attack, the electronic case management system we relied on to carry out our work is no longer available. However, we have put in place alternative processes to securely manage cases and have fully restored normal service.
Q. Do the attackers currently have access to the IT system?
No. When the incident was discovered our IT system was secured to ensure the attackers no longer had access.
Q. I have made a report under the Protected Disclosures Act, what do I need to do?
If you have made a report to this Office, you will have received an acknowledgment of your report within seven days. In general, we are obliged to transmit reports to the most appropriate body within fourteen days. In some circumstances we have to extend this timeframe. If we have to extend the timeframe for consideration of your report, you will be informed. When your report has been transmitted, you will be informed. You do not need to contact us at this stage.
Q. I wish to make a report under the Protected Disclosures Act, is this service available?
Yes, we continue to accept reports through our secure email system. As noted above, we may need to extend the time required to consider your report before we can transmit it to the most appropriate recipient. If that is the case, as noted above, we will let you know.