Ransomware Imminently Expected to Target Medical Devices

Last week's events illustrated the importance of dedicating resources to ensure that a provider's systems and procedures are up-to-date with the latest security patches, adequate antivirus measures, regular and secure data back-up systems, and security incident response plans – as those reasonable precautions alone may have been enough to mitigate the most recent threat. The attack was also a reminder that there is no substitute for preparedness and reliable information in the event of an attack.

Medical Devices are at Risk

Complicating this cybersecurity risk in health care is the looming threat to medical devices. More and more, medical devices have Internet connectivity in order to allow providers to monitor patients remotely and enable better patient outcomes, but the risks created by that trend are poorly understood by manufacturers, designers, prescribers and end-users. Most notably, medical devices do not run antivirus software, are not easily patchable and therefore are not generally updated timely, and while they are generally protected by passwords, those passwords are often easily discoverable in device documentation. Devices and other medical equipment are also commonly subject to failures to appropriately wipe localized data from user to user.

This confluence of factors makes Internet-enabled medical devices a security nightmare. The threat to end-users is very real and already here. Most estimates say that tens of millions of breaches have already occurred and patient health data has already been successfully exfiltrated by malicious actors. While the focus of the known attacks on Internet-connected devices to date has been compromising patient data for the purpose of identity theft, the Food and Drug Administration (FDA) has been warning for years that criminals could use ransomware-based attacks targeting medical devices such as insulin pumps or pacemakers in order to literally hold someone's life for ransom – while incurring almost zero risk of getting caught. It is also important to note that even devices that do not connect directly to the Internet, but that share a network with Internet-connected resources, are at risk; there have already been significant data breaches involving magnetic resonance imaging (MRI) machines and other similar devices.

In August of 2015, we previously reported that the FDA issued a warning that the Hospira Symbiq Infusion System, a widely-used insulin pump, was extremely vulnerable to a potentially life-threatening cyber-attack. Johnson & Johnson was forced to issue a similar alert concerning its Animas OneTouch Ping only last year. In September of 2015, the FBI warned broadly of the coming threat of ransomware specifically aimed at medical devices. In a recent article in a Belgian Medical Journal, an investigation found ten Implantable Medical Devices already on the market with exploitable security problems that made them susceptible to a ransomware-based attack that could directly threaten a patient's life. McAfee Labs' 2017 Threats Predictions contained the dire warning that "[w]e are certain that ransomware will readily migrate to IoT (Internet of Things, a common way of referring to Internet-enabled devices), as it has proven to be a relatively easy way for criminals to make money." Despite the various warnings over the years, however, vulnerabilities remain. In fact, the U.S. Department of Health and Human Services (HHS) recently reported that it has already received anecdotal notices of medical device ransomware infections.

Last week proved that ransomware could dramatically impact the medical industry, even when only data was at stake. Health care practitioners must seriously consider that the risk posed by ransomware goes beyond loss of data and may threaten the actual health and safety of patients' lives. Steps must be taken by all facilities to prepare for these attacks and manufacturers must account for these risks in designing their devices.

FDA's Public Workshop – Cybersecurity of Medical Devices

One way to arm yourself is to get involved. FDA, in association with National Science Foundation (NSF) and Department of Homeland Security, Science and Technology (DHS, S&T) is holding a public workshop entitled "Cybersecurity of Medical Devices: A Regulatory Science Gap Analysis." The purpose of this workshop is to examine opportunities for FDA engagement with new and ongoing research, catalyze collaboration among Health Care and Public Health (HPH), stakeholders to identify regulatory science challenges, discuss innovative strategies to address those challenges and encourage proactive development of analytical tools, processes and best practices by the stakeholder community to strengthen medical device cybersecurity.

This meeting will be held May 18 – 19, beginning at 8:00 a.m. – 5:00 p.m. at the following location:

FDA White Oak Campus
10903 New Hampshire Avenue
Bldg. 31, Room 1503
Silver Spring, MD, 20993

How to Reduce Risks and Prepare for Attack

We recommend you take the following steps to help reduce the risk of and damage from an attack: