Ireland's Employment Permits Portal Goes Offline After Unauthorised Activity
Updated: 4 minutes ago
DUBLIN, 30 October 2026 — Ireland's Employment Permits Portal has been taken offline following the detection of suspicious unauthorised activity, with authorities expecting access to be restored by 3 November 2026.
The Department of Enterprise, Tourism and Employment has confirmed that permit processing continues despite the outage, and that flexibility will apply to deadlines affected by the disruption.
What Authorities Have Disclosed
The department has described the exposure in narrow terms.
Category | Status |
Names | Potentially exposed |
Email addresses | Potentially exposed |
Account roles | Potentially exposed (employer, agent, employee) |
Broader personal data | Believed not affected |
More sensitive data categories | Believed not affected |
The operative word is "believed." The investigation remains at an early stage, and the department has not ruled out a wider scope being identified as forensic work proceeds.
A breach limited to names, email addresses and account roles is materially less serious than one involving passport scans, financial details or employment contract data — all of which the portal handles in normal operation. But "less serious" is not the same as "harmless." A verified list linking named individuals to employer, agent or employee roles is precisely the raw material for targeted phishing.
The Phishing Risk Is the Real Story
The department's own guidance points at this directly. It has warned users to be cautious about communications appearing to come from the Department of Enterprise, Tourism and Employment, or referring to the incident itself.
That warning is not boilerplate. In the days after any breach disclosure, attackers routinely send messages that mimic the breached organisation's tone and reference the very incident users are anxious about. The messages typically ask the recipient to "verify their account," "confirm their identity to protect their data," or "check whether they were affected" via a link.
The department has stated it will never ask users to disclose personal data by email or text message.
Four practical rules for anyone with a portal account:
Do not click links in unexpected emails about the incident. Navigate to the department's website directly if you want to check for updates.
Never disclose passwords in response to any unsolicited request.
Treat requests for personal, business or financial information with suspicion, even where the sender appears to know your name and role.
Do not open attachments on messages referencing the breach.
The last point matters most for employers and immigration agents, because their accounts carry higher-value access than individual employee accounts. An attacker who obtains an agent's credentials gains a view of multiple clients' applications.
What Happens to Applications in Progress
The department has been explicit that processing has not stopped.
Decisions continue to issue. Applicants will still receive updates on their applications during the outage.
Drafts and unpaid applications are preserved. When the portal returns, users will find draft applications, applications awaiting fee payment and other saved information intact.
The 28-day rule will be applied flexibly. Under normal operation, an application must be submitted within 28 days of creation. Applications that exceed that window because of the outage will not be penalised. This is the most consequential commitment in the announcement, because a missed 28-day deadline would ordinarily require the application to be rebuilt from scratch.
Renewals and Labour Market Needs Test advertising will also be treated flexibly. Both have time-sensitive elements — renewals must be filed before a permit lapses, and LMNT advertisements must run for a specified period before an application can be lodged. The department has said it will account for the disruption when assessing these.
Why the 28-Day Rule Matters
The submission window is not an administrative convenience. It exists to ensure that an application reflects current circumstances — the employer's position, the candidate's qualifications, the labour market conditions at the time of filing. An application left open for months could be lodged on the basis of facts that no longer hold.
The department's willingness to waive the consequence of exceeding it recognises that the outage, not applicant delay, caused the breach. The underlying requirement has not been suspended — only its enforcement.
Employers who were mid-preparation when the portal went down should still complete their files promptly once access returns, rather than treating the flexibility as open-ended.
What Employers Should Do Now
Brief HR and mobility teams on the phishing risk. The people most likely to receive a convincing fake email are those who have recently filed or are awaiting a decision. Make sure they know the department will not ask for credentials.
Check the status of pending renewals. Any permit approaching expiry during the outage window should be diarised. The department has promised flexibility, but documentation of the original timeline is still worth keeping.
Hold draft applications in a local file. If a submission was partially built when the portal went down, maintain a separate copy of the supporting documents. The portal should preserve the draft, but a backup costs nothing.
Do not delay responses to any department correspondence. Decisions are still issuing. If the department requests further information by email, respond within the stated timeframe.
Direct queries to the correct address. The department has asked those with concerns to contact dataqueries.permits@enterprise.gov.ie.
The Broader Pattern
This incident lands in a year of significant change to Ireland's employment permit system.
Processing times have compressed sharply — Critical Skills applications were being decided in roughly two weeks as of late October, and General Employment Permits in about five weeks. That improvement came from a multi-year move onto a unified digital platform.
A security incident at the portal is, in that context, an infrastructure risk rather than a policy one. The processing improvement depends on the platform operating. An outage of several days does not undo the gains, but a longer disruption would begin to show in the published processing dates.
Whether the incident prompts a review of access controls, authentication requirements or monitoring is a question the department has not addressed. The investigation is at an early stage, and further details may follow.
Read Also
Quick Reference Summary
Item | Detail |
Incident | Unauthorised activity detected on Employment Permits Portal |
Action taken | Portal taken offline |
Expected restoration | 3 November 2026 |
Data potentially exposed | Names, email addresses, account roles |
Data believed unaffected | Broader and more sensitive categories |
Investigation status | Early stage |
Processing status | Continuing |
Decisions issuing | Yes |
Saved applications | Preserved, accessible on restoration |
28-day submission rule | Flexibility to be applied |
Renewals | Flexibility to be applied |
LMNT advertising | Flexibility to be applied |
Phishing warning | Issued by department |
Contact for concerns |
For the latest immigration updates, visit: visasupdate.com/news
Comments