Operating rooms paralyzed, HIS unavailable, emergency rooms overwhelmed, calls from the media and the ARS coming in one after another…
This is what more and more university hospitals, hospitals, and regional hospital groups are experiencing during major cyberattacks.
Plans, procedures, and business continuity/disaster recovery plans are essential, but when a crisis strikes, one question looms large:
Have the teams ever experienced this type of situation, even in a “simulation”?
This is exactly the role of a cyber crisis management exercise in a hospital:
to simulate a realistic crisis in a secure environment so that the next one is no longer a new experience.
Why is a crisis management exercise essential for a hospital?
Better coordination between stakeholders in stressful situations
Management, IT department, CIS, healthcare management, department heads, medical information department, communications, biomedical, logistics, etc. Under normal circumstances, everyone knows their role. In a crisis, everyone comes together around the same table.
An exercise allows you to test the responsiveness of the crisis unit, clarify who decides what, and streamline communication between departments and IT.
Validate contingency plans and procedures:
A contingency plan, a business continuity plan/disaster recovery plan, or cyber procedures are only valuable if they are known, understood, and applicable under stress.
The exercise therefore highlights missing response sheets, obsolete numbers, and unworkable contingency plans in a healthcare department.
Reducing the impact of a real attack
By training, teams make the right decisions more quickly, which allows them to better maintain care in degraded mode and limit the medical, organizational, and media consequences of an attack on the hospital.
The Phishia approach, designed for hospitals
Phishia has structured its exercises around four phases, adapted to the hospital context (university hospitals, general hospitals, hospital groups).
Phase 1 – Framing and designing the exercise
Objective: to define a useful, realistic exercise that is aligned with the institution’s challenges.
Set up a project group: management, IT/CISO, care management, quality/risk management, communication, etc.
Define objectives:
test the management of ransomware encrypting the HIS,
test the switch to degraded mode in the emergency department,
validate communication with the ARS and the media, etc.
Defining the scope: isolated institution or regional hospital group, departments involved, duration of the exercise.
During this phase, Phishia provides feedback on incidents that have actually occurred in hospitals in order to propose a credible scenario that is neither too simple nor too crippling.
Phase 2 – Preparing the scenario and materials
Objective: to construct an immersive but fully controlled crisis.
We first write a coherent scenario (e.g., targeted phishing → account compromise → encryption → impact on critical services), then we prepare the main “injections”: fictitious emails (management, ARS, press, patients), a few simulated calls, and messages from service providers or hosting companies.
Finally, we produce the essential materials: player guide, instructions for facilitators, and observation grid.
Everything is prepared so that, on D-day, the exercise can take place without affecting the production IS: zero technical risk for the hospital.
Phase 3 – Conducting the exercise with the hospital crisis unit
Objective: to place the crisis unit in conditions as close as possible to a real attack.
Roles :
- Players:
Senior management, medical management, care management, IT department, chief information security officer, medical information department, communications, critical services, etc.
They receive information as it comes in and make decisions as they would in a real situation.
- Phishia facilitators:
Play the role of external actors: ARS, ANSSI, CERT, service providers, journalists, patients, etc.
Steer the process, adjust the pace, and inject information at the right moment.
- Observers:
Note reactions, obstacles, and best practices.
Do not participate in decisions.
- The process:
Creation of a hospital crisis unit (room, tools, reports).
Launch of the scenario: first weak signals, technical alerts, calls from clinical departments, etc.
Gradual increase in pressure: teams must decide to switch to degraded mode, make medical decisions, prioritize the applications to be restored, and orchestrate internal and external communication.
Throughout the session, Phishia facilitators set the pace of the crisis, and observers neutrally record what is actually happening.
Phase 4 – Feedback and improvement plan
We begin with a debriefing to gather participants’ impressions: what worked well, what caused problems, and the main points of friction.
Phishia then conducts a detailed analysis of the process (crisis unit, decisions, coordination, contingency mode) in light of national best practices. This analysis results in a prioritized action plan: updating procedures, BCP/PRA and contingency plans, improving directories and reflex sheets, and strengthening team preparedness (awareness, targeted training).
The objective is clear: after the exercise, your hospital should be significantly better prepared than before.
What Phishia brings to your hospital in concrete terms
Real-world perspective on hospital cyber crises
Our scenarios are based on real-world feedback from the healthcare sector.
Multidisciplinary approach
We involve healthcare professionals and management as well as IT/CISO departments: crises are not just a technical issue.
Education and safety
The exercise disrupts habits but takes place in a secure environment, without risk to the IT system or ongoing care.
Link to your other projects
The lessons learned directly feed into your work on the BCP/DRP, incident response, the CaRE program, awareness, etc.
Want to test your crisis response team before the next attack?
A well-designed exercise takes a few hours to prepare…
But when a real crisis hits, those hours can make the difference between an overwhelmed hospital and one that stays in control.
You want to:
- organize your hospital’s first cyber crisis exercise
- professionalize an existing crisis unit
- build an annual exercise program at the regional hospital group level
Phishia can work with you to design a customized scenario tailored to your size, organization, and level of maturity.
