--- title: "Hacking Medical Devices for Profit and Terror" description: "Discover the critical threats to medical device cybersecurity, including data theft and ransomware, and learn why current hospital security measures often…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Hacking Medical Devices for Profit and Terror - Christian Espinosa", "description": "Discover the critical threats to medical device cybersecurity, including data theft and ransomware, and learn why current hospital security measures often…", "image": "https://christianespinosa.com/__l5e/assets-v1/3537f0b4-3901-4083-87ba-f3097cf465fb/hacking-medical-devices-for-profit-and-terror-card.png", "datePublished": "2021-09-04T05:04:25+00:00", "dateModified": "2026-06-26T05:34:37.347Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/hacking-medical-devices-for-profit-and-terror" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the core idea behind \"Hacking Medical Devices for Profit and Terror - Christian Espinosa\"?", "acceptedAnswer": { "@type": "Answer", "text": "Covers background on why medical device security is something to pay attention to, the four attack objectives, and solutions." } }, { "@type": "Question", "name": "Who is this post for?", "acceptedAnswer": { "@type": "Answer", "text": "Honestly, security leaders, medical device teams, and technical operators who want the honest version, not the vendor version. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading." } }, { "@type": "Question", "name": "How do I actually apply this, not just nod along?", "acceptedAnswer": { "@type": "Answer", "text": "Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Cybersecurity](/blog/category/cybersecurity) # Hacking Medical Devices for Profit and Terror September 4, 2021 5 min read 1,144 words ##!hacking medical devicesIntroduction ![](/__l5e/assets-v1/0489eb62-abed-472a-b89d-70bccbd477b9/hacking-medical-devices-for-profit-and-terror-hero.webp) The takeaways 1. 01 Introduction I focus on four ways someone can attack a medical device. What to do next Add attack to the next leadership review as a standing item, not a one-time slide. 2. 02 Ransomware (Motive: Financial Gain) Third, I can hurt or kill a patient. What to do next Open your current ransomware plan today and identify the one gap you would not want an auditor to find. 3. 03 Background Unsecured medical devices and the Internet of Medical Things (IOMT) are major cybersecurity concerns. What to do next Open your current medical plan today and identify the one gap you would not want an auditor to find. 4. 04 These devices are typically deployed in hostile hospital and clinic environments. What to do next Ask your security lead this week for the one-page view of devices in your environment, and read it end to end. ##![hacking medical devices](/__l5e/assets-v1/b336e140-8959-40a7-aa15-6276619797d1/6f9cb278b66d.jpg) Introduction I focus on four ways someone can attack a medical device. First, I can steal a patient's health information. I do that for the money. 2. Ransomware (Motive: Financial Gain) Third, I can hurt or kill a patient. I do that for terror or assassination. 4. Using the medical device as a beachhead for enemy advancement (Motive: Foothold to Expand Operations) In this post, I will cover a little background on why medical device security is something to pay attention to, elaborate on the four attack objectives, and provide some solutions. ## Background Unsecured medical devices and the Internet of Medical Things (IOMT) are major cybersecurity concerns. These devices are typically deployed in hostile hospital and clinic environments. Yes, I said hostile. Why hostile? Most hospital environments, despite “HIPAA Compliance” remain vulnerable. I know this based on many penetration tests of both hospital and clinic environments. Compliance has little to do with security. Yet, compliance is often both the minimum and maximum effort organizations put towards cybersecurity. Attacks against medical devices are either unintentional or intentional. Unintentional, often referred to as non-directed attacks, are broad, non-targeted attacks by malware that is spreading in the “wild” by broad phishing schemes or simply lateral movement. Lateral movement is when an infected system spreads the malware to other vulnerable systems on the same network or environment. Intentional attacks also referred to as directed attacks, are targeted attacks by an entity with a specific objective. In cybersecurity, there are generally three areas we care about; confidentiality, integrity, and availability. These are often referred to as the CIA triad. The idea is if you increase one, the others may suffer, so there has a be a balance. For instance, if I focus on confidentiality and make everything super secure (encrypted, require multiple factors to log on, etc.), then availability may suffer. The balance should be based on risk. ## Medical Device Hacking Objectives ### 1\. Stealing Protected Health Information (PHI) (Motive: Financial Gain) Many medical devices contain PHI that can be stolen directly from the device, or a compromised medical device can be used to obtain PHI. For instance, a medical device may be connected to an Electronic Medical Records (EMR) system. The trusted connection between the medical device and the EMR could be used by an attacker to siphon PHI from the EMR. PHI is often stolen using targeted attacks, but can easily be stolen by a non-targeted attack, where the malicious software (malware) happens to land on a vulnerable system containing PHI. A targeted PHI attack could be an attack to get “dirt” on a celebrity or politician to blackmail them or try to smear their reputation. An example of this would be to steal records for sexually transmitted diseases (STDs) at places celebrities may have received testing. **Type of Attack: Typically non-directed, although may be targeted.** **CIA Triad Affect: Confidentiality.** ### 2\. Ransomware (Motive: Financial Gain) Ransomware is quite common in hospitals and clinics and has actually been linked to an increase in fatal heart attacks. According to a [post on the krebsonsecurity.com:](https://krebsonsecurity.com/2019/11/study-ransomware-data-breaches-at-hospitals-tied-to-uptick-in-fatal-heart-attacks/) “The researchers found that for care centers that experienced a breach, it took an additional 2.7 minutes for suspected heart attack patients to receive an electrocardiogram.” Ransomware is typically a non-targeted attack, seeking as many vulnerable victims as possible. Many medical devices run older operating systems, such as Windows XP embedded, Windows 7 embedded, or an older version of Linux. These older systems make them vulnerable to these types of attacks. **Type of Attack: Typically non-directed, although may be targeted.** **CIA Triad Affect: Confidentiality and Availability.** ### 3\. Harming or killing a patient (Motive: Terrorism or Assassination) As mentioned previously, ransomware can impose delays in treatment that can result in deaths, even though this is not the motive. Harming or killing patients motivated by terrorism or a targeted assassination typically involves altering the logic of a medical device or controlling the device to create the desired effect. An example of terrorism is [hacking into hospital patient monitoring systems](https://www.theregister.co.uk/2018/08/14/patient_monitor_hack/) to alter all the patient readings; to “flat-line” them all to create a panic and force the use of an alternative system or method. An example of an assassination is what Dick Cheney was afraid of; someone hacking into his pacemaker to cause it to stop working or shock his heart to death. **Type of Attack: If Terrorism, could be non-directed. Assassination will be targeted.** **CIA Triad Affect: Integrity and Availability.** ### 4\. Using the medical device as a beachhead (Motive: Foothold to Expand Operations) Many vendors only care about the cybersecurity of their device, focusing only on vulnerabilities that can directly affect the CIA of their medical device. Often a vulnerability in one device that may not directly affect that device can be used as a beachhead to expand hacking operations by putting a sleeper cell in friendly territory. When needed, that sleeper cell can be called upon by the hackers to wreak havoc. An example of this is an unnecessary service, such as FTP, that is running on a medical device. The service has a vulnerability that doesn’t directly affect the operation of the medical device, but could be used for future attacks by providing a point inside a friendly network that an attacker can use to amass attacks from inside a perimeter. **Type of Attack: Typically non-directed, although may be targeted.** **CIA Triad Affect: None.** ## Solutions It’s best to move from uniformed optimism to informed realism. Medical device manufacturers are excellent at making their devices reduce diagnosis time, helping a physician, or solving a medical issue. Cybersecurity is usually not an area of expertise or a concern for a medical device manufacturer. It’s understandable to see the world through the uninformed optimism lens when there is limited awareness of what is possible from a cybersecurity attack and risk perspective. The move to informed realism typically involves hiring the right cybersecurity experts that see the world differently, that look at the medical device through the lens of a hacker. They view the medical device not as a medical tool or aid, but as a system to exploit with the same objectives we discussed in this article. Hiring trusted, ethical hackers to proactively assess and test a medical device before it is deployed to a hostile healthcare environment is prudent and now mandated by the FDA. Medical devices are behind the curve with cybersecurity but are slowly catching up. Thanks to the [FDA](https://www.fda.gov/medical-devices/digital-health/cybersecurity), organizations like [Archimedes](https://www.secure-medicine.org/) and many security researchers, the real consequences to patient safety caused by vulnerable medical devices are starting to reach the right ears and be taken seriously. Need help securing your medical device? [Connect with me.](https://christianespinosa.com/cerberus-sentinel/) Frequently asked ### What is the core idea behind "Hacking Medical Devices for Profit and Terror - Christian Espinosa"? ### Who is this post for? ### How do I actually apply this, not just nod along? ### Work with me I help founders and cybersecurity leaders build teams that ship, not teams that stall. If that's the problem you're trying to solve, let's talk. [Start a conversation](/contact) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhacking-medical-devices-for-profit-and-terror&text=Hacking%20Medical%20Devices%20for%20Profit%20and%20Terror) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhacking-medical-devices-for-profit-and-terror) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhacking-medical-devices-for-profit-and-terror) [Email](mailto:?subject=Hacking%20Medical%20Devices%20for%20Profit%20and%20Terror&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fhacking-medical-devices-for-profit-and-terror)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founder & CEO, Blue Goat Cyber Christian is the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm. He's an Air Force Academy graduate, 24x Ironman, climber of two of the Seven Summits, and the author of The Smartest Person in the Room and The In-Between: Life in the Micro. Keep reading - [ ### Medical Device Hacking and the Vulnerability of Connected Medical Devices - Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/medical-device-hacking-and-the-vulnerability-of-connected-medical-devices) - [ ### If Your Reviewer Can't See the System, You Don't Have an Architecture | Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/if-your-reviewer-cant-see-the-system-you-dont-have-an-architecture) - [ ### Leetspeak: The History of Hacking Subculture's Native Tongue - Christian Espinosa Same thread: cybersecurity. Read essay → ](/blog/leetspeak-the-history-of-hacking-subcultures-native-tongue) [← Previous essay Cybersecurity Risk Needs to be Simplified - Christian Espinosa ](/blog/cybersecurity-risk-needs-to-be-simplified)[Next essay → Leetspeak: The History of Hacking Subculture's Native Tongue - Christian Espinosa ](/blog/leetspeak-the-history-of-hacking-subcultures-native-tongue) Related, Cybersecurity ### Need medical-device or offensive security expertise? Blue Goat Cyber, Christian's firm, runs FDA-aligned premarket submissions, penetration testing, and SBOM/SOUP analysis for medtech and high-stakes industries. [Explore Blue Goat Cyber](/cybersecurity) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)