New data shows that 53% of connected medical devices and other IoT devices in hospitals have a known critical vulnerability, a disconcerting statistic that follows a year of unprecedented ransomware attacks on hospitals and healthcare systems.

The vulnerabilities were disclosed in Cynerio’s  2022 State of Healthcare IoT Device Security Report, which observed that security threats related to IoT and related devices within healthcare environments have remained sorely under-addressed, despite increased investments in healthcare cybersecurity.

Additionally, a third of bedside healthcare IoT devices have an identified critical risk. These vulnerabilities could impact service availability, data confidentiality, or patient safety—with potentially life-threatening consequences for patient care. 

The report also found that IV pumps are the most common healthcare IoT device and possess a lion’s share of risk. Indeed, IV pumps make up 38% of a hospital’s typical healthcare IoT footprint and 73% of those have a vulnerability that could jeopardize patient safety, data confidentiality, or service availability if it were to be exploited by an adversary. 

Another notable concern in the industry are critical devices running outdated versions of Windows. Devices using versions older than Windows 10 account for the majority of devices used by pharmacology, oncology, and laboratory devices, and make up a plurality of devices used by radiology, neurology, and surgery departments, leaving patients connected to these devices vulnerable. 

Also, the most common IoMT and IoT device risks are connected to default passwords and settings that attackers can often obtain easily from manuals posted online, with 21% of devices secured by weak or default credentials.

“Healthcare is a top target for cyber attacks, and even with continued investments in cybersecurity, critical vulnerabilities remain in many of the medical devices hospitals rely on for patient care,” says Daniel Brodie, CTO and co-founder, Cynerio. “Visibility and risk identification are no longer enough. Hospitals and health systems don’t need more data – they need advanced solutions that mitigate risks and empower them to fight back against cyber attacks, and as medical device security providers it’s time for all of us to step up. With the first ransomware-related fatalities reported last year, it could mean life or death.