By Doreen Witt
20 July 2026

Cybersecurity in Hospitals: How KRITIS facilities can protect themselves against cyberattacks by 2026

One careless click on an email attachment, and it’s already happened: ransomware from cybercriminals installs itself on the hospital server and, in the worst-case scenario, brings the entire hospital to a standstill. This is a medical and economic disaster against which the German government is issuing urgent warnings, particularly to KRITIS facilities. From 2025/2026, the obligations regarding cybersecurity measures will be clearly enshrined in law for all medical facilities: With the NIS 2 Implementation Act and the KRITIS Framework Act, specific, legally enforceable obligations now apply to almost every hospital in Germany. What these obligations are, how vulnerable hospitals actually are, and what many institutions still fail to realise: an overview of the most important questions and answers.

How dangerous is ransomware for KRITIS hospitals?

The Latest BSI Situation Report 2025 (Reporting period: 1 July 2024 to 30 June 2025) confirmed: Ransomware remains one of the biggest threats to businesses and organisations in Germany. During the reporting period, the Federal Criminal Police Office recorded 950 reported ransomware attacks – a figure that remains largely unchanged from the previous year, but is still high. What is particularly striking is that 80 per cent of the reported attacks targeted small and medium-sized enterprises and institutions. Regardless of an organisation’s size, cybercriminals primarily seek out targets whose systems are poorly secured.

The consequences for patient safety are immense, quite apart from the immediate economic damage and long-term financial losses due to the loss of trust and image.

How real this threat is, as current reporting shows, for example: ARD is documenting this in a Tagesschau report the potential impact of the current cyberattack on the billing service provider Unimed – which is used by many German hospitals – on day-to-day operations and the care of patients.

What are the costs of a ransomware attack?

There is no general answer to this question. However, the purely financial costs can quickly run into the millions. Two examples:

The first publicly reported attack on a hospital has damage amounting to around one million euros within five days costs, amounting to 200,000 euros a day. That was in 2016, and the Lukas Hospital in Neuss, which was affected, is relatively small. The managing director quoted this figure in 2019 in a Interview. Based on the hospital’s 537 beds, this amounts to a loss of around 372 euros per bed per day.
According to the Frankfurter Allgemeiner Zeitung (paid content), one of the most well-known attacks in the industry on Frankfurt University Hospital cost “millions” of euros.

What is ransomware?

Ransomware is a type of malware developed by cybercriminals. It installs itself on a system, for example, when a user carelessly clicks on an email attachment. The criminals’ aim is usually to encrypt data and then extort a ransom from the infected company in exchange for decryption.

Which hospitals are required by law to comply with cybersecurity regulations?

Since December 2025, it has been possible to give a clear answer to this question – even though three parallel sets of regulations must be taken into account. Essentially, the following applies: There is virtually no hospital left in Germany that is not subject to statutory IT security requirements. It is only the scope of the obligations that differs.

Level 1 – Operators of critical infrastructure (KRITIS)

The following still applies: Hospitals with at least 30,000 inpatient cases per year are classified as Section 6 of the BSI-KritisV as operators of critical infrastructure. In Germany, this applies to around 150 larger hospitals. They are also automatically subject to the stricter obligations for „particularly important facilities“ under the new BSI Act, as well as the KRITIS Framework Act (see below).

Level 2 – Important and critical facilities under NIS-2

With the NIS-2 Implementation Act (NIS2UmsuCG), which came into force on 6 December 2025, requires affected healthcare organisations to comply with new requirements without a transition period, and the scope of regulated organisations has expanded significantly under NIS 2:

Key feature: with 50 or more employees, or with an annual turnover or balance sheet total of more than 10 million euros.
A particularly important piece of equipment: with 250 or more employees, or with an annual turnover of more than 50 million euros and, at the same time, total assets of more than 43 million euros.

KRITIS hospitals remain subject to the strictest supervisory and reporting requirements, regardless of the thresholds set out in the NIS2UmsuCG.

According to the Federal Office for Information Security, this means that, at both national and sectoral level, around 29,500 organisations affected – in the healthcare sector, this applies to hospitals, radiology networks and also manufacturers of medical devices. Affected organisations must register with the BSI, report significant security incidents within 24 hours and implement a range of risk management measures (Section 30 of the BSIG) – from backup management and supply chain security to multi-factor authentication. NIS-2 clearly places the responsibility on the management of hospitals and other healthcare facilities to implement the prescribed cybersecurity measures. Failure to comply may result in substantial fines.

BSI NIS-2: Important for practical application

The registration deadline with the BSI has already passed (6 March 2026). Any organisation concerned that has not yet registered should do so immediately – failure to register is not merely a formality, but is apparently subject to sanctions in its own right, regardless of whether an actual security incident has occurred.

Level 3 – All hospitals, regardless of size

Regardless of whether an organisation is classified as KRITIS- or NIS 2-relevant, hospitals have been required, since 1 January 2022, to comply with their own IT security requirements in accordance with the Patient Data Protection Act (PDSG) Section 391 of Book V of the Social Code (SGB V) (formerly Section 75c): Every hospital in Germany is obliged to put in place appropriate organisational and technical measures, in line with the state of the art, to protect its IT systems – tailored to the hospital’s operational requirements and the need to protect patient data. In order to comply with the law, the requirements of the sector-specific security standard „B3S Hospital“ to be implemented.

New from March 2026: the KRITIS Framework Act

On 17 March 2026, the KRITIS Framework Act has come into force. For the first time, it sets out uniform federal regulations governing the physical resilience of critical infrastructure – such as access control, perimeter security and emergency and crisis management. It thus complements the existing, stringent information security obligations. Operators of critical installations must for this purpose, in future with the Federal Office for Civil Protection and Disaster Assistance (BBK) register. At present, there is still none Obligation to register. For KRITIS hospitals, this means that, in addition to digital security, the physical protection of the infrastructure is now also a mandatory priority.

Who is affected and by what? NIS-2 & KRITIS in hospitals – Telepaxx

← Table scrollable →

Category	Threshold value	Core obligations	Legal basis	Competent authority
Operator of a critical infrastructure facility (KRITIS)	≥ 30,000 inpatient cases per year	Registration with the BSI 24-hour reporting requirement Intrusion detection systems Proof of implementation every 3 years	Section 56(4) of the BSIG in conjunction with Section 6 of the BSI-KritisV	BSI
A particularly important institution	≥ 250 employees or > €50 million turnover and > €43 million balance sheet total (KRITIS operators automatically included)	Registration with the BSI Risk management (Section 30 of the BSIG) 24-hour reporting requirement Personal liability of the management	Section 28(1) of the BSIG	BSI
Key institution	≥ 50 employees or > €10 million in turnover or total assets	Registration with the BSI Risk management (Section 30 of the BSIG) 24-hour reporting requirement	Section 28(2) of the BSIG	BSI
Every hospital, regardless of size	no threshold	Appropriate technical and organisational IT security measures in line with the state of the art	Section 391 of Book V of the Social Code (formerly Section 75c)	–
Physical resilience (additional requirement for KRITIS operators)	as the KRITIS threshold	No registration requirement for BBK at present Risk analysis Resilience Plan (structural and physical safety)	KRITIS Framework Act	BBK

This article is intended for general information purposes only and does not constitute legal advice in specific cases. You should consult a law firm specialising in IT and healthcare law, or refer to the official BSI impact assessment clarify.

Why is 24/7 access to data so important for KRITIS hospitals?

The rapid diagnosis, particularly in the A&E department of KRITIS organisations is virtually impossible without data.

If doctors cannot access patient files, X-rays and the like, this puts people's lives at risk. The same applies to operations and all situations in which doctors and medical staff have to make decisions under time pressure.

Which systems are at risk?

In principle, every IT system is at risk, whether in administration or medical technology. However, the German Hospital Federation defines various systems as part of the critical infrastructure.

In addition to the Hospital Information System (HIS), this also explicitly includes the Picture Archive and Communication System, or PACS for short, which is used to view and report on X-ray, CT and MRI images and the like.

Due to the large volumes of data and the high sensitivity of the data processed and archived there, PACS systems are an attractive target for attacks and encryption.

Why is image data encrypted by ransomware relevant to security?

In its comprehensive paper on industry-specific safety standards, the German Hospital Federation explicitly points out that access to image data is of serious importance for patient safety, particularly in time-critical situations such as operations.

The integrity of the data is also crucial. A ransomware attack, for example, could result in images being assigned to other patients.

Why is the PACS in hospitals of all places vulnerable to cyber attacks?

Image data is usually exchanged via the DICOM interface. Although this is a proven communication standard, it has glaring shortcomings in terms of cyber security.

Normally, neither the communication nor the stored data is encrypted by the PACS. In many cases, there is also no modern user and role management in place to prevent unauthorized access.

If image data is not stored redundantly - for example in a separate archive - the risk increases further.

How can hospitals protect themselves against cyber attacks?

The bad news: Even if you follow all the best practices for “cyber hygiene”, there is no such thing as 100% protection. These best practices include, for example, the use of strong passwords, physical access protection measures, security information and event management (SIEM) and a security operation center (SOC).

The good news: Nevertheless, all medical facilities can significantly minimize the economic and human impact of a ransomware attack by backing up operationally relevant data such as their image data multiple times, geo-redundantly and, above all, immediately available in the event of a cyber attack. Such business continuity management (BCM) concepts go far beyond a simple backup copy.

What does a coherent emergency concept look like?

As experts in secure image data management in the hospital sector, we recommend that KRITIS hospitals in particular have a comprehensive emergency concept for image data in the event of a successful cyber attack.

We have summarized the most important points for you in a checklist:

Independent image data archive that allows access to the data backed up in parallel to normal operation within minutes in an emergency - even if the PACS or HIS fails.
Geo-redundant backup of image data outside the hospital. Geo-redundant means that the data is stored on servers in different regions in Germany. This means that the data can be retrieved even if, for example, the power fails in a region near a hospital or a natural disaster occurs.
Encrypted data communication and storage in accordance with data protection and the GDPR
Access to image data via a cloud PACS in combination with mobile data hotspots ensures that emergency operations can be ramped up quickly.
Effective image data management in crisis situations – even if the hospital network, key applications or the entire IT infrastructure were to fail.

These points largely correspond to the minimum requirements set out by the Industry-specific safety standard B3S for hospitals places on effective business continuity management.

Conclusion: Reliability as a strategic advantage

Cyber security is no longer merely a technical discipline, but a management task that must be actively managed. Hospitals must act now to comply with legal requirements and ensure that patient care is safeguarded at all times.

With NIS2UmsuCG, the KRITIS Framework Act and Section 391 of SGB V, the legal framework is now more clearly defined than ever – and is expected to become even more stringent in the coming years. Hospitals that establish a resilient imaging data architecture now will not only ensure regulatory compliance but also gain a genuine competitive edge in the quality of care provided in an emergency.

Modern cloud archives provide a solid foundation for this, reduce the burden on local IT departments and effectively close risky security gaps in image management.

We would be happy to discuss the specific issues relevant to your organisation in a personal meeting – Please feel free to contact us.