Quishing, smishing, and more

Digital protective measures such as network segmentation, zero trust, and multi-factor authentication are standard today. Nevertheless, attackers regularly succeed in circumventing controls because humans are used as an attack vector. Social engineering addresses trust, habit, and cognitive shortcuts. In healthcare, this leads to data leaks, business interruptions, and, in extreme cases, patient endangerment.

Threat situation and risks

Attacks on the healthcare sector combine confidentiality, integrity, and availability risks. Patient data, core medical processes, and public trust are all affected. The European Threat Landscape Report continues to classify social engineering as one of the key threats, alongside ransomware and data attacks.

The combination of simple means and psychological patterns explains the high success rate. This is particularly true in areas where mobile devices, shared workstations, shift work, and high cycle times limit attention.

Case studies from the field of medicine

Conclusion

Technical measures are necessary, but not sufficient. Social engineering systematically addresses the human factor and therefore requires integrated defense strategies. Strengthening technology, organization, and people in equal measure measurably reduces the probability of incidents and the extent of damage.

Recommendations for action for institutions

1. Risk analysis with a focus on human vulnerabilities, especially at interfaces with patients, suppliers, and administrative processes.

2. Consolidate basic technical controls and expand them to include QR security checks.

3. Define standardized response and emergency processes and test them regularly.

4. Establish ongoing awareness with simulations, feedback, and leadership role models.

5. Continuously monitor developments in social engineering and AI abuse and derive lessons learned.

Literature and sources

• sepp.med, Lecture: Quishing, Smishing & Co. The underestimated gateways into medical infrastructure, October 17, 2025. Vortrag_CySecMed 2025

• Federal Office for Information Security: The state of IT security in Germany in 2024. BSI

• BSI: Social engineering. Fundamentals and examples. BSI

• ENISA Threat Landscape 2024. September 2024. Chapter: Social Engineering, Ransomware, and Data Threats. securitydelta.nl

• Geisler M. et al.: Hooked. A Real-World Study on QR Code Phishing, 2024. arXiv

• Kowalewski M. et al.: Scanned and Scammed. Insecurity by ObsQRity, USENIX Security 2025. USENIX

• Financial Times: Arup lost 25 mn in Hong Kong deepfake scam. 2024. Financial Times

• The Guardian: CEO of WPP targeted by deepfake scam. 2024. The Guardian

Note on data availability: The slides cite a BSI figure of 30 percent social engineering incidents in the healthcare sector. This sectoral breakdown is not found verbatim in the published 2024 status report, but the central importance of social engineering is confirmed. A precise percentage for the healthcare sector cannot be clearly substantiated from freely available sources.