Hackers can access brain scans and other sensitive data from over 1.2 million medical devices

Over 1.2 million medical devices have been found exposed on the internet, enabling hackers to access sensitive data even before patients hear their diagnosis. In some cases, attackers can alter medical records.

European cybersecurity company Modat said it had scanned the internet and found more than 70 different types of misconfigured internet-connected medical devices and systems. These include MRI, CT, X-rays, DICOM viewers, blood test systems, hospital management systems, and others.

Attackers can easily access confidential medical images, such as MRI scans, X-rays, blood work results, and other private data of hospital patients worldwide.

“Why are there MRI scanners with internet connectivity that lack proper security measures?” Soufian El Yadmani, founder and CEO of Modat, asks in the report.

“The primary risk is unnecessary network exposure. These medical systems should only be connected to secure, properly configured networks when there is a legitimate clinical need for remote access.”

The United States has the most exposed devices, with over 174 thousand, followed by South Africa (172K+) and Australia (111K+). Six more countries have over 70K exposed devices: Brazil, Germany, Ireland, Great Britain, France, and Sweden.

Japan accounts for over 48 thousand devices, and tens of thousands more were found in other countries.

Many systems lack any authentication or use very weak credentials, such as factory defaults or weak passwords like “admin” or “123456.” In other cases, misconfigurations and outdated/unpatched software contain critical vulnerabilities with existing known exploits.

“Others were simply legacy systems that are still being used, despite being out of support,” the report reads.

The researchers said they used their Modat Magnify platform to scan the internet for vulnerable devices, checking for the “device DNA” tag “HEALTHCARE.” Some of the 1.2 million devices might include honeypots. However, the results remain alarming.

The analysts shared screenshots proving they were able to access MRI brain scans, blood test results, including patients' vitals and biometrics, confidential scans of the brain, chest, lungs, legs, or other parts, and personal information. Some systems had exposed editing capabilities. The records sometimes date back to previous years.

The researchers warn that worst-case scenarios include leaking this data, leaving unsuspected victims open to fraud and blackmail. There’s also a real threat of misconfigured medical devices acting as a gateway to the networks for ransomware attacks.