health · digital · family: built to be open. now under attack
the ventilator has a password problem
Many networked medical devices in hospitals are unpatchable and exposed to cyber attack
Problem statement
Medical devices in clinical use — infusion pumps, ventilators, imaging systems, implantable cardiac devices, patient monitors — are increasingly networked and software-dependent, but many devices in the installed base were, in the FBI's words, "not initially designed with security in mind" (FBI PIN 20220912-001). The FDA's premarket cybersecurity guidance (finalized September 2023, updated June 2025 and February 2026) and section 524B of the FD&C Act — added by section 3305 of the Consolidated Appropriations Act, 2023, effective March 29, 2023 — now require new submissions for "cyber devices" to include cybersecurity plans, but the installed base of legacy devices remains largely unpatched and unpatchable. The FDA and FBI documents cited here give manufacturers and hospitals recommendations, but none of them sets out a validated methodology for assessing and remediating cybersecurity risk across heterogeneous legacy device fleets in clinical environments.
Why this matters
FDA oversees more than 6,500 different medical device products, manufactured or handled at roughly 25,900 FDA-registered medical device facilities worldwide (FDA at a Glance, January 2024), and devices increasingly carry wireless, internet and network connections (FDA premarket guidance) — a January 2022 research report cited by the FBI found 53% of connected medical and other IoT devices in hospitals had known critical vulnerabilities (FBI PIN 20220912-001). Healthcare had the highest average data-breach cost of any industry, $10.93 million, in the IBM and Ponemon Institute cost-of-a-data-breach figures for 2023 — "as in past years," in IBM's words. A successful attack on a safety-critical device — an infusion pump, a pacemaker — could directly endanger patients. Since FDA began enforcing the new cybersecurity requirements on October 1, 2023, device-security firm MedCrypt reports a 700% increase in cybersecurity-related deficiency letters among the manufacturers it works with, and FDA has publicly stated that deficiency letters that include cybersecurity deficiencies carry an average of fifteen of them — indicating that even new submissions struggle to meet the standard.
What’s been tried and why it hasn’t worked
The FDA's September 2023 premarket guidance (since updated in June 2025 and February 2026 to address section 524B) superseded 2014 guidance with detailed recommendations for threat modeling, software bill of materials (SBOM), coordinated vulnerability disclosure, and cybersecurity risk assessment — but these are nonbinding recommendations on device design, labeling and what goes into premarket submissions. Section 524B (which MedCrypt calls the PATCH Act amendment) similarly requires cybersecurity plans, vulnerability monitoring, and an SBOM in premarket submissions; its obligations attach to whoever submits a premarket application for a cyber device. Legacy devices — those already on the market or in use — are addressed by FDA's 2016 postmarket guidance, which contains nonbinding recommendations to manufacturers. Hospitals can isolate a device from the network as a compensating control — the FBI recommends this where replacing the device is not feasible — but the FBI also lists the substantial number of managed devices on the network among the routine challenges. FDA's Cybersecurity page lists two white papers, from October 2024 and April 2026, on the challenges of SBOM data normalization. One possible reason, which the cited sources do not state, is that manufacturers of legacy devices have limited economic incentive to issue patches for products generating no ongoing revenue. Medical device hardware often remains active for 10-30 years while manufacturer-specified software life cycles range from a couple of months to the device's maximum life expectancy, and legacy devices do not receive manufacturer support for patches or updates — leaving them running outdated software (FBI PIN 20220912-001).
What would unlock progress
A lightweight, standardized risk-scoring framework for triaging cybersecurity vulnerabilities across heterogeneous medical device fleets would enable hospitals to prioritize remediation even without manufacturer cooperation. Automated asset discovery and SBOM analysis tools purpose-built for clinical environments could give hospitals visibility into what is actually running on their networks. A regulatory or economic mechanism that creates incentives (or mandates) for legacy device manufacturers to provide security updates — or at minimum, SBOMs — for fielded devices would close the gap between new and legacy requirements.
Entry points for student teams
A student team could prototype an automated medical device network scanner that identifies connected devices, infers their software components, and maps them against known vulnerability databases (CVE/NVD) to produce a prioritized risk report. Another approach would be designing a network micro-segmentation policy generator specifically for clinical environments that balances security isolation with clinical workflow requirements. Teams with backgrounds in cybersecurity, networking, embedded systems, or healthcare IT would be well-suited. A scoped semester project could work with a simulated hospital network environment (e.g., using open-source medical device emulators) rather than requiring access to live clinical infrastructure.
Genes
Structural cousins: stuck the same way, in other fields
Sources
FDA Final Guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions" (February 2026; supersedes the June 27, 2025 and September 27, 2023 finals), FDA CDRH/CBER, Docket FDA-2021-D-1158, FDA Digital Health Center of Excellence, "Cybersecurity," FBI Private Industry Notification 20220912-001, "Unpatched and Outdated Medical Devices Provide Cyber Attack Opportunities" (2022-09-12), Accessed 2026-08-20. go to source 1 ↗ go to source 2 ↗ go to source 3 ↗
Working notes
Notes made while writing and checking this brief, shown as written. They use working shorthand.
Key references include the FDA Premarket Cybersecurity Guidance (September 2023), FDA Postmarket Management of Cybersecurity in Medical Devices guidance (https://www.fda.gov/files/medical%20devices/published/Postmarket-Management-of-Cybersecurity-in-Medical-Devices---Guidance-for-Industry-and-Food-and-Drug-Administration-Staff.pdf), MedCrypt analysis of the PATCH Act's first-year impact (2024), and Sternum IoT's FDA cybersecurity guidelines overview (2024). This brief is related to digital-scada-adversarial-ai-robustness (similar OT security challenges in industrial settings) and digital-autonomous-system-runtime-resilience (analogous challenges in maintaining safety properties of fielded software systems). Tagged as "worsening" because the number of connected medical devices is growing while the legacy installed base remains vulnerable.
Reconciliation 2026-08-20: The sole cited URL was FDA's generic guidance-search page, not the guidance document; replaced with the guidance's own page (https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-management-system-considerations-and-content-premarket — that page confirms the February 2026 final, Docket FDA-2021-D-1158, supersedes the June 27, 2025 final, which in turn superseded the September 27, 2023 final; retitled "Quality Management System Considerations..." in the current version). Statutory attribution corrected: section 524B was added to the FD&C Act by §3305 of the Consolidated Appropriations Act, 2023 ("Ensuring Cybersecurity of Medical Devices"), effective March 29, 2023 — the PATCH Act itself was never enacted (confirmed on FDA's Cybersecurity page). Quantitative repairs, each checked against its source: "257,000 device types / 22,000 facilities" was unsourceable and did not match FDA's own figures — replaced with FDA at a Glance, Jan 2024 (>6,500 device products; 25,901 registered device facilities; https://www.fda.gov/media/175664/download). Breach-cost claim re-anchored to IBM's 2023 Cost of a Data Breach findings ($10.93M healthcare average, highest industry 13 years running; https://www.ibm.com/think/insights/cost-of-a-data-breach-healthcare-industry). The 700%-deficiency-letter increase is MedCrypt's observation across its client base, and the fifteen-deficiencies average is an FDA public statement reported by MedCrypt — both now attributed (MedCrypt, "One Year Later," Naomi Schwartz, 2024-10-02, https://www.medcrypt.com/blog/one-year-later-the-impact-of-the-patch-act-and-final-premarket-guidance-on-medical-device-cybersecurity). Lifecycle claim ("10–20 yr vs 3–5 yr") re-anchored to the FBI PIN's verified language (hardware active 10–30 yr, software life cycles far shorter, no manufacturer support for legacy devices); the unverified "Windows XP / old embedded Linux" example was softened, and the FBI's 53%-of-connected-devices figure added. The 2026-08-18 retag rationale above kept its original wording; the corrected differential (10–30 yr vs shorter software support) still satisfies the temporal:mismatch sub-type. Postmarket guidance PDF URL in these notes re-verified live (December 2016 final, Docket FDA-2015-D-5105). All Source-line URLs verified live 2026-08-20.
Reconciliation 2026-09-30: The whole write-up was read against every source it names, all fetched on 2026-09-30. Fetched in full: the FDA guidance page on the Source line and the guidance document it links (https://www.fda.gov/media/119933/download, issued February 3, 2026); FDA's Cybersecurity page; the FBI notification (the Source-line address now redirects to https://www.ic3.gov/CSA/2022/220912.pdf); FDA's 2016 postmarket guidance; FDA at a Glance, January 2024 (https://www.fda.gov/media/175664/download); the IBM page (https://www.ibm.com/think/insights/cost-of-a-data-breach-healthcare-industry, and Internet Archive copies of it from 2026-07-23 and 2026-09-26); the MedCrypt post; and the Sternum IoT article, which the notes name without a link (found at https://sternumiot.com/iot-blog/fda-cybersecurity-guidelines-for-medical-devices-2024-guide/). The FBI notification, FDA at a Glance and the guidance page were read end to end; the longer documents were searched for each claim. (1) Title: "Millions of Networked Medical Devices in Hospitals Are Unpatchable and Exposed to Cyber Attack" is now "Many Networked Medical Devices in Hospitals Are Unpatchable and Exposed to Cyber Attack." No source gives a count of devices; the FBI says "many medical devices." (2) "The majority of the installed base was designed without cybersecurity controls" is not in any source. The FBI lists "devices not initially designed with security in mind" among the weaknesses of many medical devices; the sentence now quotes that phrase and says "many." (3) "There is no validated methodology" for hospital device fleets is not stated by any source. The sentence now says what can be seen in the documents: they give recommendations, and none sets out such a methodology. (4) FDA at a Glance says products are "manufactured or handled" at registered facilities; "manufactured at" now reads "manufactured or handled at." (5) "A significant fraction of fielded devices are networked" is not in any source. The FDA guidance speaks of "the increasing integration of wireless, Internet- and network-connected capabilities"; the sentence now says that. (6) "For 13 consecutive years" is not on the IBM page, in today's copy or in either archived copy. The page says healthcare had the highest average breach cost "as in past years," at 10.93 million USD, alongside figures it dates to 2023; the sentence now says that. The page calls the report "the 2024 Cost of Data Breach Study" while giving 2023 figures, so the text no longer names a report year. (7) The harm example "an infusion pump, a ventilator" now reads "an infusion pump, a pacemaker." The infusion pump is supported by FDA's postmarket guidance (a vulnerability affecting the dosage of an insulin infusion pump, cited for the severity of patient harm); the pacemaker is one of the devices the FBI names when it says compromised devices can endanger patient health. No source mentions ventilators. (8) The guidance is marked "Contains Nonbinding Recommendations" and covers what goes into premarket submissions, so "detailed requirements ... these apply only to new submissions" now reads "detailed recommendations ... these are nonbinding recommendations on device design, labeling and what goes into premarket submissions," which is how FDA's own page describes the guidance. (9) "The enacted successor to the proposed PATCH Act" is not in any source. FDA's pages do not mention the PATCH Act; MedCrypt calls section 524B "the PATCH Act amendment." The text now says MedCrypt calls it that. (10) "Creating a two-tier system where legacy devices operate under weaker protections indefinitely" is not in any source. The text now gives the two facts the sources do state: section 524B's obligations attach to whoever submits a premarket application for a cyber device, and FDA's 2016 postmarket guidance, which is nonbinding, applies to "legacy devices, i.e., devices that are already on the market or in use." (11) "Segmentation is imperfect and operationally burdensome across fleets of thousands of devices from dozens of manufacturers" is not in any source. The FBI recommends "isolating the device from network" where replacement is not feasible, and lists "a substantial number of managed devices on the network" among routine challenges; the sentence now says that. (12) "SBOM standards are not yet mature enough for automated vulnerability correlation" is not in any source. FDA's Cybersecurity page lists two white papers on SBOM data normalization challenges (October 24, 2024 and April 22, 2026); the sentence now says only that the page lists them. (13) The sentence on manufacturers' limited economic incentive to patch is not in any source. It is kept, but now says plainly that it is a possible reason the sources do not state. (14) The FBI says software life cycles range "from a couple months to maximum life expectancy per device," not that they "end far earlier," and it speaks of "outdated software," not operating systems; the sentence now follows the FBI's wording. (15) "Replacing it would cost billions" in the first paragraph of these notes is not in any source and was removed. Confirmed in the sources and left as written: the Source line (guidance title, February 2026, docket FDA-2021-D-1158, the June 27, 2025 and September 27, 2023 predecessors; the FBI notification's number, title and date); section 524B added by section 3305 of the Consolidated Appropriations Act, 2023, effective March 29, 2023 (FDA's Cybersecurity page; the guidance itself names the same section as part of the Food and Drug Omnibus Reform Act of 2022); the guidance replacing the 2014 guidance; threat modeling, SBOM, coordinated vulnerability disclosure and risk assessment as its contents; more than 6,500 device products and 25,901 registered device facilities; the FBI's 53% figure and its January 2022 date; hardware active for 10-30 years; MedCrypt's 700% increase since October 1, 2023 and FDA's average of fifteen cybersecurity deficiencies per letter; the postmarket guidance link (issued December 28, 2016, docket FDA-2015-D-5105). Could not be confirmed and left as written: ventilators in the list of networked devices and in the Display title (no source names them; the FBI's advice on default passwords does support the "password problem"); "largely unpatched and unpatchable," which is the write-up's summary of the FBI's statement that legacy devices do not receive manufacturer patches or updates. Two statements in the 2026-08-20 note above could not be found on the pages it cites as they stand today: that FDA's Cybersecurity page says the PATCH Act was never enacted, and that the IBM page says "13 years running." The 2026-08-18 line above also still carries the older "10–20 yr vs 3–5 yr" figures, which are not the FBI's. A second reader went over all fifteen repairs the same day against the same sources, fetched independently (the second reader reached the Internet Archive copy of the IBM page from 2026-09-26, whose text matches the live page; the 2026-07-23 copy rests on the first reader's account); eleven stand as written, and four (2, 7, 8, 12) were tightened to the wording recorded here so that each says no more than its source. Genome tags untouched.