Organisation information
Cybersecurity Incident: Your Questions
From Commission for Public Service Appointments (CPSA)
Published on
Last updated on
From Commission for Public Service Appointments (CPSA)
Published on
Last updated on
Q. What has happened?
On Thursday 11 December 2025 we were the subject of a random cybersecurity attack on our IT systems.
It is understood that this was a random attack and a forensic investigation is ongoing. As a precaution, some systems were initially taken offline to contain the threat while the incident was investigated.
However, all public-facing services have now been restored.
Q. Has my data been accessed?
We have been working closely with forensics experts to fully investigate this incident. Arising from this work we are confident at this time that no personal data was taken.
Q. What action has been taken to protect my data?
Once we became aware of the incident our priority was to protect the data of people who rely on our services and to restore services safely.
The NCSC (National Cyber Security Centre) activated its incident response plan and put in place enhanced monitoring to support the CPSA.
The incident was also notified to the Data Protection Commissioner and An Garda Síochána.
To further protect the data of individuals, we have taken legal steps, including securing an injunction from the High Court to restrict any publication of potentially stolen information. That said, we are confident at this time that no personal data was taken.
For general guidance relating data protection, please see the Data Protection Commission website . For general advice relating to the cyber security, please see the National Cyber Security Centre website .
Q. What services are impacted?
All public-facing services have been restored. However, we continue to experience some delays in progressing cases.
Q. Do the attackers currently have access to the IT system?
No. When the incident was discovered our IT system was secured to ensure the attackers no longer had access.
Q. I have made a complaint to the CPSA, what do I need to do?
Due to the disruption to our systems, we are experiencing delays in processing complaints and ask that you bear with us. However, you do not have to resubmit your complaint or contact us at this stage.
Q. I have made a report to the CPSA under the Protected Disclosures Act, what do I need to do?
If you have made a report to the CPSA as a prescribed person under the Protected Disclosures Act, you will have received an acknowledgment of your report within seven days. However, we may experience delays in carrying out follow-up on your report and ask that you bear with us. You do not need to contact us at this stage.