The healthcare system, on guard before the wave of cyberattacks in Europe
Some hackers want to access delicate data and others, to compromise the functioning of the centers
BarcelonaFirst it was several supermarkets in Northern Europe and, later, the cooling system of a French blood bank. Europe is experiencing a wave of cyberattacks that the Cybersecurity Agency (ENISA) and the European Commission qualify as "serious" due to the impact it may have on essential services and infrastructure and the significant economic losses it may entail. The authorship of none of the incidents has yet been confirmed and national and community authorities have not verified whether they are part of any coordinated operation. However, the temporal coincidence has alerted one of the sectors that accounts for two out of every five cyberattacks in Europe: the healthcare system. In Catalonia, the Cybersecurity Agency managed about 2,200 incidents last year, although none forced the interruption of healthcare activity, according to government sources.
When talking about possible cyberattacks on Catalan hospitals, it is inevitable to think of the incident at the Hospital Clínic of Barcelona in March 2023 with ransomware. A group hijacked sensitive information, encrypted it, and demanded a ransom to avoid publication on the deep web. The consequences were unprecedented and lasted over time: a large part of the activity had to be done manually, with paper and pen, because professionals could not access medical records or share digitized information. In that situation, alternative measures were activated, such as facilitating professionals' access to La Meva Salut and the shared medical history to attend to emergencies and make patient referrals.
Now cyberattacks in Europe have highlighted another concern: hackers are no longer looking only to steal information, but to paralyze the functioning of essential services such as hospitals, which increasingly depend on digital platforms, applications, technological providers, and connected infrastructure. In fact, ransomware continues to be one of the main threats, but there has always been sabotage, activism or, simply, the ego of hackers, that is to say the will to demonstrate that they have the capacity to penetrate a public system of great reach. All in all, the director of the Cybersecurity Agency of Catalonia, Laura Caballero, warns that often the motivation is not even known.
In the face of this growing threat, can the Catalan healthcare system be completely shielded? "We do not have absolute security. It is a permanent race between those who try to find vulnerabilities and those of us who work to fix them," admits the TICSalut coordinator, Pol Pérez. No system is invulnerable, especially in a context where threats are constantly evolving and intrusion methods are increasingly sophisticated. The key, notes Pérez, is not to promise total protection of the system, but to have mechanisms in place to prevent, detect, and respond to incidents as quickly as possible.
Simulations and ethical attacks
The attack on the Hospital Clínic marked a turning point in the way of approaching cybersecurity for the Catalan public healthcare system. Following that episode, the Department of Health and the Cybersecurity Agency of Catalonia accelerated a protection program for healthcare infrastructures and services. The plan, deployed for three and a half years, is applied to primary care, social-health centers, intermediate care, and public mental health centers. What is the program based on?
The Agency carries out a continuous review of vulnerabilities and acts as a kind of ethical hacker, that is, it tries to detect possible weaknesses in the systems by self-attacking before external groups attack in order to define protection measures and adapted security plans. Drills are also carried out to prepare centers for a possible incident and work is done to ensure they have contingency plans on how to organize themselves, which actions should be prioritized, and which systems should be disconnected to minimize risks. "The program will never end because threats change," warns Pérez.
If a few years ago the main concern was protecting medical records and patients' personal information, now it is also necessary to think about the continuity of services. Many public activities depend on technological platforms and some medical services are based on applications; thus, communications between professionals or access to certain services may be compromised if an infrastructure they depend on goes down. “Before, we were worried about computers and servers. Now anything can be vulnerable and can be attacked and what is important is having the capacity for a response,” summarizes Caballero.
In this scenario, one of the most delicate points is the dependence on external technological providers. A hospital may have its own protection measures, but if a company that provides services to it becomes the gateway for an attack, it can be compromised. "It is what is known as the supply chain risk", indicates Caballero, who adds that, to reduce the risk, Health and the Agency have incorporated specific clauses into contracts with providers.
Hiring of providers
Companies that opt to work with the healthcare system must meet cybersecurity requirements, among which is the obligation to access hospital systems via a virtual private network (VPN) and two-factor authentication. “This adds a layer of protection, even if it makes the access process a bit more cumbersome,” notes Pérez. Not all providers, however, have the same level of criticality. Those that manage essential services or platforms where important applications run are much more integrated into the protection and monitoring systems and “are very aware of their criticality,” which is why they have contingency plans. In contrast, with less critical providers, the strategy consists more of sending alerts and recommendations for them to review their systems.
And what happens if a Catalan provider suffers an attack, as happened with the French blood bank? The first measure is to cut its connection to prevent the incident from spreading. Then it is necessary to correct the problem and analyze the responsibilities, which will depend in large part on the obligations established in the contract. The two experts from the Generalitat explain that a provider that has been attacked despite complying with all required measures is not the same as one that has not done its homework in terms of security. In this second case, the administration may have more arguments to demand accountability. "We have the capacity to monitor that providers do things as they should. But we are talking about mitigation and protection measures, of resilience. Zero risk does not exist," assures Caballero.
Another issue that causes concern is to what extent a cyberattack could affect physical infrastructure such as electricity, hospital climate control, operating rooms, or systems for preserving medical products. The officials interviewed distinguish between computer systems connected to digital networks and certain infrastructures that operate on internal networks. In this sense, they explain that lighting, climate control, and operating rooms in Catalan hospitals are not remotely controlled through external networks, but rather have their own electronic systems. They also recall that hospitals have contingency plans and generators to deal with possible supply interruptions, as happened during the general blackout of 2025.
The Cybersecurity Agency managed 9.1 billion attempted attacks on Generalitat services in 2025 and the majority were blocked by the initial defense systems, so the institution only managed 6,500 of them. Of these, 26 were considered serious and required some form of more specific intervention. "The most significant data is that, despite the increase in attack attempts, serious incidents have been reduced by 20%", indicates Caballero.
