The Internet of Medical Things: Healthcare’s New Top Target for Cyberattacks

Introduction

Hospitals today are increasingly filled with smart devices—from Wi-Fi infusion pumps and wireless patient monitors to network-connected imaging machines—all part of the Internet of Medical Things (IoMT). These connected medical devices promise efficiency and better patient outcomes, even automating tasks traditionally done by nurses. Yet this digitization comes at a cost: it has expanded the attack surface for cybercriminals.

Healthcare systems have become prime targets for hackers, as evidenced by a 45% surge in cyberattacks on health organizations globally since late 2020. Adversaries recognize that medical data is extremely valuable and that disrupting clinical services can put lives at risk, making hospitals more likely to pay ransoms. In short, as IoMT adoption accelerates, so does the urgency of securing clinical environments against cyber threats.

IoMT and the Expanding Threat Landscape

The explosion of IoMT devices in hospitals has fundamentally altered the healthcare cybersecurity landscape. Smart hospitals worldwide are projected to deploy over 7 million IoMT devices by 2026—double the number from 2021. Each connected infusion pump, heart monitor, or robot trolley represents a potential entry point for attackers. Unfortunately, many of these devices were not built with security in mind. Over half of connected medical devices contain at least one unpatched critical vulnerability, creating easy opportunities for hackers.

The healthcare industry has become a prime target for cybercriminals due to the vast amount of sensitive patient data and the critical nature of medical services. Threat actors range from organized cybercriminal gangs seeking profit (e.g., via ransomware) to nation-state hackers and malicious insiders. They are attracted by the sensitive patient data and the life-or-death stakes—a combination that often pressures victims to promptly meet attacker demands.

Global trends reinforce this alarming picture. The WannaCry ransomware outbreak in 2017 illustrated how a single cyber weapon could wreak havoc worldwide—it hit over 200,000 systems across 150 countries, including dozens of UK hospitals. More recently, in late 2020, Europe and Asia saw the sharpest rise in healthcare attacks (over 100% increase in some regions). Even regions with stronger defenses were not spared; North America still experienced a significant spike in hospital cyber incidents. These trends underscore that no healthcare system, from small clinics to national hospital networks, is immune. As the IoMT ecosystem expands, the attack surface becomes borderless, requiring a coordinated global response to defend patient care from cyber harm.

Cyber Threats Exploiting IoMT Vulnerabilities

Healthcare institutions face a gamut of cyber threats leveraging IoMT weaknesses. Some of the most pressing threats include:

Ransomware Attacks

Ransomware is arguably the gravest threat, with attackers infiltrating hospital networks, encrypting critical systems and IoMT devices, then demanding payment. This can cripple clinical operations. For example, the 2017 WannaCry attack forced 19,000+ appointment cancellations in the UK’s National Health Service by locking down medical PCs and devices. Ransomware often enters via phishing emails or by exploiting unpatched device vulnerabilities. Once inside, it spreads rapidly across networked equipment. Because lives are on the line, hospitals feel immense pressure to pay ransoms to restore systems. As of 2022, roughly two-thirds of healthcare facilities globally had experienced a ransomware attack.

Data Breaches and Theft of PHI

IoMT devices frequently handle sensitive protected health information (PHI)—vital signs, medical histories, images, etc. If compromised, they can serve as gateways to larger hospital databases. Attackers prize PHI because it can be sold for identity theft or insurance fraud. Over 133 million patient records were exposed in healthcare data breaches in 2023. In one notorious case, hackers accessed a medical lab’s systems and exposed data on 12 million patients.

Medical Device Hijacking (MedJack)

Attackers have developed malware tailored to hijack medical devices, taking advantage of their outdated software and weak defenses. Once inside a device, the malware can disrupt its function or use it as a foothold into the wider network. For instance, the MEDJACK malware discovered in 2015 targeted devices like heart monitors, MRI machines, and insulin pumps. Such attacks can alter the functionality of critical devices—imagine changing an infusion pump’s drug dosage or disabling an alarm on a patient monitor.

Device Tampering and Patient Harm

Perhaps the most frightening scenario is a hacker intentionally manipulating a life-sustaining device to hurt a patient. Security researchers have shown this is more than theoretical. In 2018, analysts found severe vulnerabilities in certain pacemakers made by Medtronic that could be exploited to remotely control the devices. Similarly, demonstrations at security conferences have hacked IV infusion pumps to deliver lethal doses of medication by altering their software.

Distributed Denial-of-Service (DDoS) via IoMT

Many IoT and IoMT devices have minimal security and can be conscripted into botnets. An attacker might infect hundreds of hospital devices (like smart thermostats, networked security cameras, or even internet-enabled lab equipment) and use them collectively to launch DDoS attacks. The target could be the hospital itself—flooding its network to knock critical systems offline—or some external victim.

Real-World Cyberattacks on Hospitals and Medical Devices

Numerous case studies illustrate that these threats are not hypothetical—they are already hitting hospitals around the world with devastating impact. A few notable examples include:

• WannaCry Ransomware – NHS (United Kingdom, 2017): This attack infected over 80 hospital trusts in the UK, locking down medical devices, CT scanners, and blood lab systems. Thousands of surgeries and appointments were canceled. The attack cost the NHS an estimated £92 million in lost services and IT recovery.
• University Hospital Düsseldorf Ransomware (Germany, 2020): A ransomware attack encrypted servers coordinating patient care. A critically ill patient died after being re-routed to a more distant hospital because Düsseldorf’s emergency department was forced offline.
• Universal Health Services Outage (U.S., 2020): A ransomware attack on a major hospital chain forced facilities across the country to revert to pen-and-paper documentation for weeks. The incident cost the organization $67 million in recovery and lost operations.
• Medtronic Pacemaker Vulnerabilities (Global, 2017–2018): The FDA issued an unprecedented recall for 465,000 pacemakers due to cybersecurity flaws that could allow remote reprogramming.

Steps Hospitals Must Take to Strengthen Cybersecurity

Hospitals must implement a multi-layered approach to defend against these threats. Key steps include:

• Comprehensive Asset Inventory
• Network Segmentation
• Timely Patching and Updates
• Strong Access Controls
• Encryption of Data and Communications
• Continuous Monitoring and Threat Detection
• Incident Response Planning

Conclusion

The rapid adoption of IoMT devices has revolutionized healthcare, but it has also introduced unprecedented security risks. Cyberattacks on hospitals are no longer hypothetical; they are an active, evolving threat that can jeopardize patient safety and operational continuity. The future of medicine depends not just on innovation, but on the security measures that safeguard it.

‍