UZA Hospital prevents cyber incidents linked to human errors

When hospitals fall victim to hackers, lives are at risk. Technology enables modern medicine but also forces these institutions to adopt new techniques to secure their networks. "Every hospital is doing its utmost to make its staff more aware of today's digital threats," says Filip Goyens, DPO at UZA (University Hospital Antwerp), "and we are doing so by putting Phished at the centre of our strategy."

Organizations hit by ransomware or other malware often face two options: pay a ransom to regain control of their network, or wait for IT to restore systems from backups. Neither option is reassuring for healthcare institutions—organizations where budgets are typically directed toward patient care. And if the waiting period is too long, the consequences can be severe. In such environments, the term “critical infrastructure” takes on an even greater meaning.

“Over the past two years, we’ve worked hard to put cyber awareness higher on the agenda,” says Goyens. “We regularly consult with DPOs from various hospitals and share best practices—e-health is certainly not new to us. The recent hacks of large hospitals, such as those in Tournai and Mol, show just how necessary this work is. Of course, every hospital has its own focus, and for us, that means using the Phished platform.” 

Over the past two years, UZA has made a major shift in its cyber awareness policy. In the past, it relied on traditional communication tools such as brochures and the quarterly staff magazine; today, it is fully embracing digital channels. “We’ve been using screensavers on our network computers for some time to quickly share useful information, including phishing and ransomware prevention tips,” says Goyens. “But we noticed that many people were still vulnerable to these tactics.”

“It’s not that we were facing major incidents,” Goyens explains, “but we did have smaller ones in the past that we were fortunate to resolve quickly. As a healthcare institution, however, we didn’t want to wait for a major hack to strike. That’s why we commissioned an external audit two years ago—the results reinforced our decision to look for a structural solution. We now rely on the algorithm to train our colleagues, and the numbers prove it works.”

At the time of Phished’s baseline measurement, about 30% of all recipients fell for phishing attempts—an average result. Within just a few months, that number dropped to 8%. “We’ve clearly seen a return on investment,” says Goyens. “Thanks to the platform’s detailed reporting, we’ve watched the numbers decline week after week, which gives us both satisfaction and peace of mind. The recent Facebook incident was yet another reminder to be vigilant—not only with systems, but also with personal data.”

Strong results in phishing simulations reinforce our confidence that we’re meeting our responsibilities,” says Goyens. “We can now respond even faster if we see that an employee—or even an entire department—needs extra support. And we continue to rely on the algorithm to train our colleagues; the data proves it works.” 

UZA is currently developing a centralized Security Operations Center to make collaboration between the various IT teams involved in cyberattack prevention more efficient. This will enable faster, more targeted responses to potential threats and streamline prevention efforts. Phished plays a key role in these plans through its automated phishing simulations, in-depth reporting, and automatic staff updates—scalability is a critical factor for large organizations.

Phished plays an important role in bringing these plans to life through its automated phishing simulations, in-depth reporting, and automatic staff updates—after all, scalability is a critical factor for large organizations.