When a ransomware attack hits a hospital, screens go dark, electronic records disappear, laboratory results stop arriving, and ambulances may be diverted. Health systems in many countries have suffered attacks that disrupted care for days or weeks. Cybersecurity is no longer just an IT problem. It is a patient safety issue, and nurses are on the front line.
This guide explains why healthcare is targeted, how phishing and ransomware work, the warning signs nurses should know, what to do when systems go down, and simple habits that protect patients, colleagues and you.
Imagine you are on a busy morning shift when an email arrives from “IT Support”: your password expires in one hour, click here to keep access. You are about to give medicines and you cannot afford to be locked out. You click, enter your password, and think nothing of it. Three days later, the hospital’s systems are encrypted and a ransom demand appears on every screen. Investigators trace the first entry to a stolen password. It could have been anyone’s. That is why every nurse needs to recognise a phishing email.
Why are hospitals targeted?
- Valuable data: health records contain identity, insurance and financial details.
- Urgency: hospitals cannot stop working, so attackers expect them to pay quickly.
- Complex systems: many connected devices, old software and third-party suppliers.
- Busy staff: people under pressure click quickly.
Common threats
| Threat | What it is | Example |
|---|---|---|
| Phishing | Fake emails designed to steal passwords or install malware | “Your payslip is ready, log in here” |
| Smishing and vishing | Phishing by text message or phone call | A caller pretending to be IT asking for your login |
| Ransomware | Malware that encrypts systems and demands payment | All computers locked with a ransom note |
| Credential theft | Stolen or shared passwords used to access systems | Logging in as you to view records |
| USB and device threats | Infected drives or unsecured personal devices | A “found” USB stick plugged into a ward PC |
| Insider misuse | Staff accessing records without a reason | Looking up a celebrity or a neighbour |
How to spot a phishing email
- Urgency or threats: “Act now or lose access”.
- Unexpected requests for passwords, codes or payments. IT will never ask for your password.
- Odd sender addresses: look closely at the domain.
- Links that do not match: hover (on a computer) to see the real address.
- Attachments you did not expect, especially invoices, payslips or “shared documents”.
- Too good to be true: bonuses, prizes, free gifts.
- Spelling and formatting that feel slightly wrong (though AI-written phishing is often polished).
If in doubt, report it. Use your organisation’s “report phishing” button or forward it to IT. If you clicked or entered details, tell IT immediately; quick reporting limits damage, and you will not be the first person to make the mistake.
Everyday habits that protect patients
- Lock or log out of workstations every time you walk away.
- Never share your login, even with a colleague who “just needs to check something”.
- Use strong, unique passwords and multi-factor authentication.
- Do not plug unknown USB drives or personal phones into hospital computers.
- Do not send patient information through personal messaging apps unless your organisation approves them.
- Only access records you need for the patients you are caring for.
- Keep personal devices updated if they connect to work systems.
- Be careful what you post on social media about your workplace, rota or systems.
When systems go down: downtime procedures
Every nurse should know what to do if the electronic health record, medicines system or laboratory systems fail. Ask your unit for its downtime plan and check:
- Where are the paper forms (observations, medication charts, fluid balance, admission documents)?
- Is there a downtime report printed regularly with current patients, allergies and medications?
- How will laboratory and imaging results be communicated (phone, runners)?
- How do you verify medicines without barcode scanning?
- How will information be re-entered into the system once it is restored?
- Who leads communication, and how will you receive updates?
Practise downtime procedures before you need them. In a real outage, the safest units are the ones that have rehearsed.
Medical devices and the Internet of Things
Infusion pumps, monitors, imaging equipment and even beds can be connected to networks. Report devices that behave strangely, never bypass security settings, and follow clinical engineering guidance on updates.
Confidentiality is part of cybersecurity
Most data breaches in healthcare are not dramatic hacks but everyday lapses: records viewed without reason, documents emailed to the wrong person, photos of patients taken on personal phones. Nursing codes of conduct require nurses to protect confidential information. Breaches can lead to disciplinary action and loss of registration. See our guide to nursing ethics.
Frequently asked questions
Why do cyberattacks matter to nurses?
They can shut down records, results and medicine systems, delaying care and putting patients at risk.
What should I do if I clicked a phishing link?
Report it to IT immediately and follow their instructions, including changing your password.
Only if your organisation has approved it and has rules for its use. Otherwise, use approved secure systems.
What is a downtime procedure?
A plan for continuing safe care using paper and phones when electronic systems are unavailable.
But is cybersecurity really part of nursing?
Yes. Protecting confidentiality has always been a nursing duty. In digital hospitals, that duty includes recognising phishing, protecting passwords and keeping care safe when systems fail. A single careful nurse can stop an attack before it starts.
Your next step: Before your next shift ends, find your unit’s downtime procedure and the location of its paper forms. If you cannot find them, ask your manager, and suggest a short downtime drill.
Related: Nursing ethics · AI in nursing · Ambient AI scribes
Sources: World Health Organization and national cybersecurity agencies’ guidance for healthcare; health sector cybersecurity alerts; nursing regulators’ codes on confidentiality. Follow your organisation’s IT and information governance policies.
Leave a Reply