What happened?
At the anniversary conference of hospital IT managers in Berlin, Prof. Sebastian Schinzel and Nico Brüggemann from the Fraunhofer Institute for Secure Information Technology (SIT) presented a crisis simulation of a cyberattack on a fictitious hospital typical for Germany. In a seminar, 23 participants took on 12 roles – ranging from IT and management to medical leadership and nursing staff, as well as information security and the crisis team. The goal was to determine whether a hospital remains operational when its IT systems completely fail.
What was simulated was not the technology itself, but the organizational response – using realistic firewall excerpts, matching names, domains and networks, as well as so-called injects, i.e., simulated events such as press inquiries or system failures.
The Details
The simulated attack begins unspectacularly: using classic OSINT research (Open Source Intelligence), the attacker gathers email addresses, names, roles, and clues about external systems from the hospital's website. Based on this, a tailored phishing email is crafted. In the scenario, an IT staff member with administrative rights falls for it. The attacker then uses the VPN access, scans the network, finds an Exchange server, and steals credentials there. From this point on, according to Brüggemann, essentially the entire Active Directory is considered compromised.
Escalation follows: suspicious logs, data exfiltration, failing systems such as the hospital information system, radiology and laboratory systems – and finally a ransom note.
In the exercise, the escalation chain from the administrator through IT management and the information security officer (ISO) to the management board worked well, as did clear fundamental decisions such as refusing to pay the ransom and disconnecting the hospital from the internet. The return path proved more difficult: the crisis team became a one-way street, with information flowing in but barely flowing back out. IT staff sometimes sat in an adjoining room without knowledge of the decisions that had been made.
One key finding concerned documentation: during the exercise, someone asked about a measure that had long since been decided – but no one had recorded it. The reflexive reaction of immediately shutting everything down also proved problematic: an uncontrolled shutdown destroys forensic traces, and it is often unclear which systems are urgently needed at that moment, for example during a surgical procedure. The better approach is usually targeted network segmentation.
When IT fails, invisible processes also collapse: admissions, findings, image archives, medication, duty rosters, and meal supply. The exercise therefore also addressed courier runs, shift changes, and pragmatic solutions such as paying salaries based on the previous month's amount, since recalculation was not possible.
Context
Schinzel, who has been active in the IT security scene for over 20 years and previously worked as a penetration tester himself, emphasized: "I have never experienced this kind of dynamic before." He pointed to a possible future threat from malware that accesses an LLM and adapts itself – in which case the classic countermeasure of cutting the internet connection might no longer be effective, for instance if attackers find a GPU internally on which they can run a small model.
Schinzel draws on his own experience from the ransomware attack on FH Münster in 2022. From other affected universities, he heard how crises can spiral out of control: IT managers placed on leave, departments that stop communicating with each other at exactly the moment when communication is vital for survival.
Particularly revealing is the finding regarding recovery time: teams often estimate a return to normal operations within days, but weeks to months are more realistic. A case near Frankfurt known to Brüggemann took about a year to return to its original state – and in that instance, data wasn't even encrypted, only the Active Directory had been compromised. Backups remain indispensable, but they do not solve the problem of a compromised infrastructure.
Practical Tips
- Organize the crisis team around two-way communication: people are needed who continuously move from room to room and keep everyone involved up to date.
- Define fixed roles for documentation and situational overview: Who records decisions, who maintains the list of measures, who handles internal and external communication?
- Assign roles with designated backups rather than tying them to specific individuals, since people may become unavailable.
- Avoid reflexively shutting everything down – instead, consider targeted network segmentation and preserve forensic evidence.
- Prepare analog fallback processes for admissions, medication, duty rosters, and meal supply in case email, Teams, and telephony fail.
- Plan for realistic recovery timeframes – weeks to months rather than just days.
Outlook
The simulations are scientifically designed: processes and decisions are evaluated, and participating hospitals receive a final report. Fraunhofer SIT is currently seeking additional hospitals to participate in the study. The scenarios are adapted in advance to each respective IT environment via questionnaire, while remaining comparable to one another. Brüggemann emphasized to heise online that only a larger number of exercises will ultimately yield reliable data. Participant feedback flows directly into the further development of the simulation and emergency processes.
For the hospital IT sector, the exercise thus provides important insights: information security cannot simply be delegated to the IT department but affects the entire organization – from nursing staff to management. Especially in hospital networks with multiple locations, the situation can quickly become complex in an actual emergency, as one exercise participant summarized.
