A cyberattack on a hospital is not just about data. It is about admissions capacity, diagnostics, medication, communication and whether critical care continues to function. The European action plan on the cybersecurity of hospitals and healthcare providers therefore puts not only prevention, but also detection, preparedness, response and recovery at the centre.
When an IT failure becomes a risk to care delivery
Digitalisation improves processes, connects institutions and enables new forms of care. At the same time, dependence on available systems grows. If a central system fails, the consequences are not merely technical disruptions: treatment may be delayed, emergency departments come under pressure and employees must continue working without the information they are used to having.
When presenting its action plan, the European Commission referred to 309 significant cybersecurity incidents in the European healthcare sector in 2023 — more than in any other critical sector. The figure is historical, but the operational message remains current: healthcare institutions are an attractive target and often have little scope for prolonged outages.
Four capabilities determine resilience
Detect
An incident must become visible early enough. Individual security tools are not sufficient for this. What matters is whether technical signals, reports from employees and indications from external partners converge in one place and can be assessed quickly.
Prepare
Organisations need robust fallback processes, up-to-date contact lists, clear decision-making authority and rehearsed scenarios. An emergency manual only becomes effective when those involved know it and can apply it even under time pressure.
Respond
During an attack, technical containment, safeguarding care delivery, internal leadership, communication and regulatory reporting must work in parallel. Unclear responsibilities can cause teams to block one another or decisions to be taken too late.
Recover
Backups alone do not guarantee recovery. Systems must return in an order that makes sense professionally, data states must be reliable, and clinical and administrative areas need clear transitions from emergency operations back to normal operations.
What the European action plan provides for
The published EU action plan sets out phased measures for 2025 and 2026. These include guidelines, tools, services and training tailored to the healthcare sector. ENISA is also to establish a pan-European support centre for hospitals and healthcare providers.
For institutions, this does not mean waiting for European offerings. Rather, the action plan sets a clear benchmark: cyber resilience is measured by whether an organisation detects threats, acts with preparedness, remains capable of leading during an incident and restores operations in a controlled way.
A practical 90-day focus
A meaningful starting point need not begin with a major project. Within 90 days, key questions can be answered with confidence:
- Which five systems are most critical to patient care and ongoing operations?
- Which manual or technical fallback options exist in the event of a multi-day outage?
- Who decides on isolation, shutdown, external support and communication?
- Are backups technically separated, tested regularly and recoverable in a prioritised sequence?
- Have executive management, medical leadership, nursing, IT, data protection and communications jointly rehearsed a realistic scenario?
The answers quickly show whether emergency capability is merely documented or actually in place.
Conclusion: Cybersecurity is operational stability
Hospitals cannot prevent every attack scenario. But they can influence how early an attack is detected, how reliably decisions are made and how quickly care delivery can be stabilised. The EU action plan thus shifts the focus from protection technology alone to the capacity for action of the entire organisation.
Primary sources and scope of validity
- European Commission: European action plan on the cybersecurity of hospitals and healthcare providers, accessed 11 August 2026. It substantiates the target model, fields of action and phased action framework for 2025/2026.
- European Commission: Presentation of the action plan, 15 January 2025, accessed 11 August 2026. It substantiates the historical incident figure and the context of the initiative.