Abstract:Importance: Cybersecurity is an increasingly important threat to health care delivery, and email phishing is a major attack vector against hospital employees. Objective: To describe the practice of phishing simulation and the extent to which health care employees are vulnerable to phishing simulations. Design, setting, and participants: Retrospective, multicenter quality improvement study of a convenience sample of 6 geographically dispersed US health care institutions that ran phishing simulations from August 1, 2011, through April 10, 2018. The specific institutions are anonymized herein for security and privacy concerns. Exposures: Simulated phishing emails received by employees at US health care institutions. Main outcomes and measures: Date of phishing campaign, campaign number, number of emails sent, number of emails clicked, and email content. Emails were classified into 3 categories (office related, personal, or information technology related). Results: The final study sample included 6 anonymized US health care institutions, 95 simulated phishing campaigns, and 2 971 945 emails, 422 062 of which were clicked (14.2%). The median institutional click rates for campaigns ranged from 7.4% (interquartile range [IQR], 5.8%-9.6%) to 30.7% (IQR, 25.2%-34.4%), with an overall median click rate of 16.7% (IQR, 8.3%-24.2%) across all campaigns and institutions. In the regression model, repeated phishing campaigns were associated with decreased odds of clicking on a subsequent phishing email (adjusted OR, 0.511; 95% CI, 0.382-0.685 for 6-10 campaigns; adjusted OR, 0.335; 95% CI, 0.282-0.398 for >10 campaigns). Conclusions and relevance: Among a sample of US health care institutions that sent phishing simulations, almost 1 in 7 simulated emails sent were clicked on by employees. Increasing campaigns were associated with decreased odds of clicking on a phishing email, suggesting a potential benefit of phishing simulation and awareness. With cyberattacks increasing against US health care systems, these click rates represent a major cybersecurity risk for hospitals.

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study

The Anatomy of Deception: Measuring Technical and Human Factors of a Large-scale Phishing Campaign

Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training

Phishing simulation exercise in a large hospital: A case study

The Effects of Group Discussion and Role-playing Training on Self-efficacy, Support-seeking, and Reporting Phishing Emails: Evidence from a Mixed-design Experiment

The Anatomy of Deception: Technical and Human Perspectives on a Large-scale Phishing Campaign

A Study of Different Awareness Campaigns in a Company

Spear phishing in a barrel: Insights from a targeted phishing campaign

Detecting and Characterizing Lateral Phishing at Scale

Falling for Phishing: An Empirical Investigation into People's Email Response Behaviors

SoK: Human-Centered Phishing Susceptibility

Less is More: Exploiting Social Trust to Increase the Effectiveness of a Deception Attack

Phishing in an Academic Community: A Study of User Susceptibility and Behavior

The Phishing Email Suspicion Test (PEST) a lab-based task for evaluating the cognitive mechanisms of phishing detection

Quantifying Susceptibility to Spear Phishing in a High School Environment Using Signal Detection Theory

Education and Training Against Threat of Phishing Emails

Comparative Simulation of Phishing Attacks on a Critical Information Infrastructure Organization: An Empirical Study

So Many Phish, So Little Time: Exploring Email Task Factors and Phishing Susceptibility

All About Phishing: Exploring User Research through a Systematic Literature Review

Large Language Model Lateral Spear Phishing: A Comparative Study in Large-Scale Organizational Settings

Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions