Viruses with particularly devastating consequences

If hospitals or clinics fall victim to cyber attacks, this means they are on red alert: Red alert. Not only because highly sensitive patient data can fall into the wrong hands, but also because the entire infrastructure is now "connected" to the internet, making every device a potential target. Because everything is networked, there is a risk that a virus or Trojan could bring the entire system to a standstill.

The danger is not just theoretical, it is real. In the UK, for example, a ransomware virus brought 45 hospitals and clinics to a standstill in spring 2017, and almost 7,000 appointments and operations had to be postponed. In Germany, malware brought the Lukaskrankenhaus hospital in Neuss to a standstill - numerous operations had to be postponed as a result.

Blackmail through encryption

Institutions in Switzerland have also had similar experiences. Last year, a cyber attack in Schöftland in the canton of Aargau paralyzed the administrative system of a care center, with hackers encrypting the electronic files of 108 residents. As the data was also stored in paper form at the same time, operations could still be maintained. The home's management nevertheless agreed to the blackmailers' demands and paid around 7,700 francs in bitcoins to decrypt the data.

Attackers usually exploit the greatest vulnerability of hospitals and clinics: the employees. Like most people, they also make mistakes and are careless when it comes to IT security. They inadvertently open attachments, fall victim to phishing and unknowingly spread viruses. In contrast to other industries, where cybercrime is often "only" extremely expensive, disregarding security rules in hospitals can even have life-threatening consequences for the patients concerned.

Campaign and courses to help

It is therefore of great concern to the Confederation that hospitals are protected as well as possible against attacks from cyberspace. The Coordinated Medical Service (KSD) and E-Health Suisse, the competence and coordination center for the Confederation and cantons, the Federal Office for Civil Protection FOCP (Risks Division) will be working with H+, the umbrella organization of hospitals, clinics and care institutions, to combat digital risks from mid-October. Specialist courses on cyber security are also planned.

The client chose Mediacreators for the campaign. "We received three offers, one from Germany and two from Switzerland," says director Mike Wyniger. "Ours was the most expensive, but had the clearest ideas and the best concept. Which makes me very happy, because it's not just the cheapest that gets the job, which is unfortunately so often the case."

Short film instead of "explanatory groove"

The Bern-based company is not only responsible for the production, but also for the concept and the script. Wyniger explains that the client had actually planned a conventional awareness spot. "Too boring", he thought, and suggested producing a short feature film for social media instead. "Something that captivates people. After all, social media in particular is oversaturated with films with the classic "explanatory groove" that tells viewers what they should do or how they should behave," Wyniger is convinced.

The result is the three-minute film "A digital nightmare". It tells the story of a hospital employee who unwittingly becomes the prime suspect in a cyber attack. The reason: in good faith, she had plugged a USB stick found on the hospital floor into her computer in order to find out the owner and enable it to be returned. This carelessness was enough to infect the entire hospital system. The unsuspecting and surprised employee finds herself being questioned by the police. In the end, it was just a dream. A nightmare with a warning finger.

Attacks via various channels

The method of deliberately placing supposedly lost storage media as "bait" in order to gain access to employees' devices does indeed exist. Even if in reality the majority of attacks are carried out via email. Sometimes with internal hospital senders to make the emails look trustworthy and relevant. "We opted for the USB stick version because it is much easier to film than a phishing attack via email," says Wyniger. When making the film, the director paid particular attention to ensuring that the message reached the target group as simply and directly as possible. "The film should also work without sound so that it can be watched on a smartphone on the streetcar, for example," says Wyniger. The image should be clear and uncluttered. "It was important to me that the film wasn't littered with fade-ins or other distracting elements."

Authentic extras

The fact that the film could also score points with the target group with its authenticity is helped by the cast: Professional actors were only used for the main actress and the police investigator; all the extras are amateurs, some of whom were recruited by the KSD from its own ranks. For example, a real doctor plays the doctor.

It remains to be hoped that the campaign will have the desired effect. For once, success is not only in the interests of the customer and the contractor, but of society as a whole. After all, cyber security in hospitals is everyone's business.

Thomas Häusermann

This article is from the print edition of Werbewoche (issue 17/2018)