What does a cyberattack on a hospital subject to NIS2 look like?
6 October 2026
At 07:10, the morning shift starts normally. At 08:25, a doctor cannot open a patient record; 15 minutes later registration fails; at 09:05, an administrator establishes that the intrusion began the previous night. Staff see the hospital attack only now, at the registration desk and in a consulting room without test results, after the attacker has moved through the network for many hours.
Key information
- Losing access to systems causes the greatest harm – records eventually return; interrupted appointments and postponed procedures cannot be undone.
- The attack begins outside medical systems – with a compromised administrative employee account, followed by a search for network privileges.
- The impact shows in daily workflows – registration moves to paper, diagnostics slow down, and wards coordinate by phone.
- Effective defence depends on people, procedures and response time – tools reveal an event; someone who knows what to do in the first hour stops it.
- NIS2 counts the hours from when the facility becomes aware of an incident – an early warning within one day and a full notification within three days.
Why are hospitals targeted by cyberattacks?
A healthcare facility cannot suspend operations even for a few hours. Medical data has value on the criminal market, but availability provides the real leverage: a ward unable to see orders and results works more slowly with every hour of downtime.
According to ENISA, healthcare was the most frequently reported sector under the NIS Directive for four consecutive years, and ransomware remains the dominant incident type. In Poland, healthcare is part of an essential sector under the Act on the National Cybersecurity System. Hospital cybersecurity and medical data protection are no longer matters for the IT department alone.
How does a cyberattack begin?
The entry point is rarely a medical system. More often, it is a message sent to an administrative employee, a compromised password or an internet-facing remote service without a second authentication factor. IBM’s 2025 report attributed 16 per cent of the breaches analysed to phishing.
The first hours often appear unremarkable. Mandiant reports that, in 2025, the median time between attacker entry and detection was 14 days – typically, the organisation continues operating for that long without knowing about the incident. For a healthcare facility, this indicates that the attacker was present long before systems stopped responding.
What happens in the IT environment?
The attacker does not immediately look for patient records. They seek privileges, because those open everything at once. From inside the hospital, the cyberattack becomes a series of small steps, each resembling a routine administrative action on its own.
Compromising accounts and privileges
A compromised employee account offers little on its own. Access to Active Directory is valuable because it determines who can log in to what across the network. The attacker therefore collects credentials from workstations, searches for highly privileged accounts and moves between servers using ordinary administration tools. In event logs, this movement looks like the IT team’s work.
When does the attack reach medical systems?
The HIS (Hospital Information System) manages records and orders, PACS (Picture Archiving and Communication System) stores and shares medical images, and email connects communications with laboratories. Encrypting any one of them stops a different part of the facility’s operations. The hospital experiences ransomware as several simultaneous outages: some wards lose treatment histories, others lose image access, and registration can no longer confirm appointments.
What are the consequences for the hospital?
Staff first feel the loss of information needed at the bedside. Treatment continues, but under emergency procedures: more slowly, with decisions made without a complete history of examinations. This is why step-by-step cyberattack response takes a different form than in a company that can suspend a service for a day.
Returning to emergency procedures
Paper-based work can last longer than the contingency plan anticipates. After the 2021 attack on Ireland’s Health Service Executive, facilities lost access to clinical, laboratory and imaging systems, and restoring the environment took more than four months.
In healthcare, cybersecurity is therefore measured by operational continuity and the time taken for someone to recognise and interrupt an incident. At VigilHorizon, we begin discussions with facilities by examining these two issues together: how long it currently takes to notice an unusual signal, and who has authority to decide before the attack reaches systems supporting care.
How would a SOC detect this attack?
The scenario illustrates a hospital cyberattack from a detection perspective. Each stage leaves a signal that can be noticed before an encryption message appears. This requires someone to read the signal and have a basis for comparison.
That is the role of a SOC, or Security Operations Center: a team monitoring security. It works with data from a SIEM, Security Information and Event Management, which correlates logs from multiple systems. This is why monitoring alone is not enough to stop an attack.
Attack stages and their corresponding detection points:
| Attack stage | SOC detection opportunity |
|---|---|
| Phishing targeting an administrative employee | Analysis of email and user reports |
| Unusual login on a compromised account | Event correlation in SIEM |
| Privilege escalation in Active Directory | Detection rule alert and analyst verification |
| Lateral movement between servers | Analysis of account and workstation behaviour |
| Initial encryption attempts | Incident response: host isolation and network segment disconnection |
At VigilHorizon, we treat an alert as a case with an owner. At shift change, the ticket is handed over with a record of what has already been checked. The incoming analyst can close the case or disconnect a threatened segment without convening a meeting. Detection is work carried out by people guided by procedures, and its value is measured by how soon someone interrupts the attack.
How do NIS2 requirements help reduce the impact?
The NIS2 Directive includes hospitals in the health sector. It requires specific capabilities: incident handling, business continuity, backups, access control and staff training. This is explained in the overview of the monitoring requirements that actually need to be met.
Poland’s National Cybersecurity System Act has applied since 3 April 2026, and the ISMS must be implemented by 3 April 2027. Separate reporting deadlines apply: an early warning within 24 hours and a full notification within 72 hours, measured from when the organisation becomes aware of the incident. The facility’s state of preparation is assessed through NIS2 compliance auditing.
How 24/7 security monitoring changes an incident:
| Element | Handling during IT business hours | 24/7 security monitoring with response |
|---|---|---|
| An out-of-hours or weekend signal | Waits in the queue until the next working day | Reaches the on-duty analyst immediately |
| Decision to isolate a host | Requires management contact and is delayed | Follows the playbook and the team’s assigned authority |
| The 24-hour early-warning window | Runs from becoming aware of a significant incident, regardless of the staffing model | Runs from becoming aware of a significant incident; continuous analysis can enable earlier recognition |
| Extent of the attack in the environment | Reconnaissance and lateral movement have time to reach medical systems | Reconnaissance may be interrupted earlier |
For the facility’s management, one figure in this comparison matters: how many hours a signal waits for assessment. That number is later reflected in the attack’s reach and in the point when reporting deadlines begin.
How can risk be reduced?
The greatest benefit comes from shortening the path from the first signal to a decision. This is where hospital security monitoring starts to deliver value, because simply adding tools primarily increases the number of events to handle. A useful starting point is understanding what an IT security audit covers.
In our work with healthcare facilities, rehearsing the first hour makes the biggest difference. The team has documented roles: who confirms the incident, who informs management and who speaks to the medical system supplier. A procedure nobody has rehearsed falls apart into a series of phone calls on the day of an incident.
Measures that materially shorten response time:
- Round-the-clock handling – the hospital’s SOC works with its data, including on days off.
- Email and identity oversight – Microsoft 365 monitoring detects new forwarding rules.
- Network segmentation – separating medical systems from the office network limits lateral movement.
- Multi-factor authentication (MFA) – a password alone is no longer enough for remote access.
- Audits and training – reveal differences between documentation and configuration, while staff report suspicious messages earlier.
Backup and recovery after an attack
Backups restore data; they do not shorten detection time. Two parameters matter: RTO (Recovery Time Objective, the target time for restoring a service) and RPO (Recovery Point Objective, the acceptable amount of data loss). A safe backup is one the attacker cannot modify or delete – hence the 3-2-1-1-0 approach, with an immutable copy and tested recovery.
Hospital operational continuity therefore relies on two layers at once: detection and response by the security team, and recovery delivered through SecureVault.
An alert is not the end of monitoring, but the start of the work. The scale of an incident is determined by how many minutes pass before someone reads the alert, understands it and makes a decision.
Where should you start to prevent a cyberattack from stopping care?
A hospital cyberattack goes beyond an IT department problem: it disrupts systems supporting care, lengthens patient service times and puts pressure on staff. How much work can continue becomes apparent in the first hour: the person on duty either has a documented scenario and authority to activate it without seeking approval, or just a phone number for their manager.
This is where we most often help healthcare facilities. We recommend security audit when the actual state of the environment needs to be assessed, NIS2 compliance auditing when the question concerns obligations and deadlines, and a 24/7 SOC deployment when the facility needs a team interpreting its signals every day of the week.
Frequently asked questions (FAQ)
Does NIS2 cover hospitals?
The health sector is listed in Annex I of the NIS2 Directive, and healthcare is an essential sector under Poland’s National Cybersecurity System Act. Whether a facility is an essential or important entity depends on its size and the outcome of its self-assessment.
Who reports an incident at a healthcare facility, and when?
The organisation should designate people responsible for preparing and submitting notifications. For a significant incident, NIS2 requires action without undue delay: an early warning within 24 hours and an incident notification within 72 hours of becoming aware of it. The final report is generally due within one month of notification. If the incident is ongoing, a progress report is submitted, followed by a final report within one month of completing incident handling. Applicable national and sector-specific rules determine the details.
How can an ongoing incident be recognised before systems stop working?
A new administrative account, a login from an unusual location or a rule forwarding email to an external address may be a signal. Each fact can look harmless in isolation, so comparing events across different systems is what reveals them.
Are backups enough to protect against ransomware?
Backups help only when the attacker cannot access them. If copies sit in the same domain without protection against modification, ransomware can reach them alongside production systems.
How can medical systems that cannot be updated frequently be protected?
Equipment with limited maintenance windows is separated through network controls and strict access control, rather than forcing configuration changes. Oversight then focuses on surrounding traffic: who connects, from which segment and at what time.
Where should a facility begin preparing for NIS2 requirements?
Start with an inventory of systems supporting care and identify which failures would stop wards from operating. That list sets the sequence for procedures, recovery tests and monitoring scope.
Learn more
Related articles
Not sure which plan is right for your business?
Complete a short questionnaire
Complete the form and we will help you select monitoring, incident handling or availability support for your organisation. We will agree the scope and service conditions before work begins.