The FBI issued a Private Industry Notification targeted to the health care sector on September 12, 2022, warning that it has “identified an increasing number of vulnerabilities posed by unpatched medical devices that run on outdated software and devices that lack adequate security features.”

The potential threats identified include outdated software that is unable to be patched or hasn’t been patched, devices using default configurations that can be exploited by threat actors, and devices that did not incorporate security features during the development stage.

The FBI uses industry research to outline that “as of January 2022…53% of connected medical devices and other internet of things (IoT) devices in hospitals had known critical vulnerabilities. Approximately one third of health care IoT devices have an identified critical risk potentially implicating technical operations and functions of medical devices.”

The identified medical devices that “are susceptible to cyber-attacks include insulin pumps, intracardiac defibrillators, mobile cardiac telemetry, pacemakers, and intrathecal pain pumps. Malign actors who compromise these devices can direct them to give inaccurate readings, administer drug overdoses, or otherwise endanger patient health.”

Unpatched medical devices truly present a life-or-death risk to health care organizations and patients.

The Notification outlines a number of recommendations to address the security of medical devices, including endpoint protection, identity and access management, asset management, vulnerability management, and required training for employees.