Constantly evolving threats and risks within the healthcare and public health (HPH) sector require coordinated and effective preparedness, response, and recovery actions within and between the public and private sectors across the globe. In recognition of the value achieved through focused discussion between health sector organizations and government agencies, Health Information Sharing & Analysis Center (Health-ISAC) created the Hobby Exercise Series. The Hobby Exercises are intended to be held regularly to keep sector entities and their government partners engaged and informed on cybersecurity challenges and the best ways to respond to widely impactful incidents. This document summarizes the discussion and findings from the second European Hobby Exercise, held on October 15, 2024 in Athens, Greece. Organizations can use this document to educate themselves on the challenges faced during large-scale cybersecurity incidents and to identify areas for improvement.
Participants included representatives from Health-ISAC, healthcare delivery organizations (HDOs), medical device manufacturers (MDMs), and pharmaceutical manufacturers. A representative from ENISA provided opening remarks but was unable to stay for the exercise. No other EU government entities participated. Participants were provided with fictional situation reports that escalated across multiple phases. During each phase, questions were posed that prompted discussion regarding how the varied participants would respond, including what information they would be seeking both within their organization and from external partners, and what they would expect government agencies and other members of the sector to be doing. Often the discussion would focus on a particular area of interest to the group, where the sharing of lessons learned between the participants was encouraged. The half-day exercise concluded with valuable insights and practical steps organizations can build into their plans, procedures, and operations to prepare for a multifaceted incident. Open conversations, held under Chatham House Rule, resulted in several key findings and recommendations regarding sector challenges and engagement with government partners.
Download this report to learn about the two overarching themes highlighted throughout the discussion:
Supply chain concerns
Lack of cohesion within the interaction between national governments and private health sector organizations
