Cyber threats are on the rise. Online criminal activities are becoming more frequent, targeted, and complex. Every industry is now at constant risk of a data breach, ransomware attack, or criminals accessing their network and taking control of their systems. And the healthcare industry is no exception — especially after the pandemic.
Statistics show that in the third quarter of 2022 alone, at least one in every 42 healthcare organizations was impacted by ransomware. These attacks affect all areas of the healthcare system, including medical devices. With the advancements of the Internet of Medical Things (IoMT), even the most unlikely medical devices have become a target for cyber-attacks.
So far, there hasn’t been any documented direct attack on a medical device. However, the fact that it’s possible is a matter of concern, and everyone should educate themselves and take extra steps to secure devices against cyber threats.
Here are the top six devices that are most vulnerable to cyber-attacks and why.
6 Medical Devices You Didn’t Know Could Be Targeted by Cybercriminals
Many people think that cybercriminals only target online marketplaces and financial institutions. Nothing can be further from the truth. In fact, the healthcare industry is currently one of the main targets. Here are some of the medical devices criminals target:
1. Drug-infusion pumps
These devices are used to supply patients with different drugs, including antibiotics, pain relievers, insulin, and even chemotherapy drugs.
A few years ago, experts from ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) found multiple vulnerabilities in certain types of wireless-connected drug-infusion devices. They found that hackers could access the devices using wireless connections.
For example, an insulin pump tracks a patient's blood glucose levels and transmits this data wirelessly to the patient’s healthcare providers. The app works through a system that consists of a sensor, pump, connecting meter, and mobile app. As long as they are online any of these can be a door that hackers use to access the whole system.
2. Pacemakers
In 2018, researchers found that pacemakers produced by Medtronic had severe vulnerabilities that cybercriminals could exploit to control the devices remotely.
Typically, hackers can gain access to and control the medical device through the external device that is used together with the device. For example, suppose the device can be controlled through a computer or a mobile app. In that case, it’s possible for people with malicious intent to hack into the external device and potentially interfere with the medical device.
In an interview with Dr. Sanjay Gupta, former US Vice President Dick Cheney confessed that his heart defibrillator had to be modified before being implanted to avoid the risk of it being hacked by terrorists who targeted his life.
There hasn’t been any reported case of hackers interfering with pacemakers and other implantable medical devices yet. However, manufacturers and healthcare practitioners are now working to ensure the devices are more secure.
3. Wearable Health Devices
Wearable medical devices are another category of healthcare devices that is highly vulnerable to online criminal activities. Like drug-infusion pumps and pacemakers, criminals can potentially hack into these devices for data harvesting, ransom, and even to blackmail the patient.
Hackers can hack into these devices in order to gain access to the wider network of the patient’s home or the hospital where the patient is treated.
However, these devices have a lower risk than pacemakers and drug-infusion pumps since the criminal is less likely to harm the patient directly.
4. MRI Devices
Typically, MRI systems are interwoven with the hospital systems to help seamlessly transmit data and images from one system to another. This makes them highly vulnerable to cyber-attacks.
They can be used as a backdoor for hackers to access the hospital network. Once they have access, they can shut down the hospital system until a ransom is paid. A good example is the 2017 “Wannacry'' ransomware, which affected over 200,000 computers, including medical devices, in several UK hospitals. Most of the hospitals claim that their radiology equipment was affected by the attack.
5. Medical Records
In this age of the internet, healthcare facilities rely heavily on technology and devices connected to the internet. All patient data is recorded online; patient health records, lab results, etc. This is good for the patient as it helps with data integration, clinical support, and patient engagement.
However, this can make it easy for people with malicious intent to siphon this information and use it against the patient. On a larger scale, they can harvest all the hospital data and hold it at ransom. For example, Quest Diagnostics, a large blood-testing company in the US, was hacked in 2019, and data belonging to more than 12 million patients were exposed.
Why Do Cybercriminals Target Medical Devices?
Criminals target the healthcare industry for a reason. Here are the key reasons why medical devices are vulnerable to cyber-attacks:
- Medical Devices Offer an Easy Entry Into the Hospitals System
IoMTs like pacemakers, insulin pumps, x-rays, and defibrillators are some of the greatest innovations of this century. But in some cases, they are like an open wound that invites cybercriminals to attack the hospital systems.
Although these devices rarely store personal data, hackers can leverage them to attack hospital systems. They can use the devices to access the wider hospital network and mine data or hold it at ransom.
- Targeting Individuals
Criminals can access medical devices and use them to kill patients remotely. For example, they can hack into a pacemaker and stop the patient's heart or hack into an insulin pump and use it to administer a lethal dose of the medicine, thus killing the patient.
There hasn’t been a reported case of individual targeting, but this issue needs much attention. Imagine what could happen if terrorists could hack into medical devices and their targets remotely.
- Steal Personal Health Information
In the wrong hands, some people’s private medical information can be worth a lot of money — which is one of the reasons why cyber threats are increasing in the healthcare industry. For example, criminals can steal prominent people's medical records and sell them to the media.
Additionally, criminals can use stolen medical records to purchase medication or make false medical claims. This can directly or indirectly affect the patient's health or personal life.
- Corrupting Systems
Computer viruses often don’t distinguish between business, home, and hospital networks. They affect all IoT devices. To mine data, criminals try their luck with any connected device available on the target's network.
So if they are targeting a hospital, medical devices are one of the things they can check for vulnerabilities. And if they gain access, the effects can be felt immediately.
- Poor Cybersecurity Efforts in the Sector
Most of the entities in the industry don’t have the technology necessary to shield themselves against these advanced entities. Although medical technology has advanced significantly over the last decade, the healthcare industry is yet to develop the necessary security muscle to keep up with it.
For example, most medical device manufacturers don’t factor in the device’s cybersecurity while developing the device. To keep up, the manufacturers and all the parties involved need to ensure that all devices, software, and systems come with advanced security features. These should also be updated often to stay secure amidst all the technological advancements.
To help protect their systems, hospitals should also invest in updated medical devices with better security features. They can also consider paying for these medical devices using net 30 accounts if funds are not immediately available.
Conclusion
As these IoMTs become smarter and more connected, they become more and more vulnerable to cyber threats. Sometimes the threats go beyond fraud and data theft, and affect the financial health and reputation of the medical facility.
Therefore, medical device security vulnerabilities are real and should be monitored and guarded against. So hospitals and medical device manufacturers should up their game and make strategic decisions that will help protect the devices against all cyber threats.
Note: This blog article was written by a guest contributor for the purpose of offering a wider variety of content for our readers. The opinions expressed in this guest author article are solely those of the contributor and do not necessarily reflect those of GlobalSign.
