The threat that worries security teams most is not the one that drains a wallet or darkens a data centre. It is the one that reaches a device keeping a patient alive. As cyber pressure on Western infrastructure intensifies, the question readers keep asking is a fair one: how are implanted pacemakers and artificial hearts actually defended against a state-sponsored attacker?
The short answer is layered design, mandated testing and a lot of unglamorous engineering. The longer answer starts with what these devices are and how they came to be regulated at all.
What Counts As A Medical Device
A medical device is any device intended for medical purposes, and in countries around the world it must be proven safe and effective before it reaches the market. The higher the associated risk, the more testing is required to establish safety and efficacy. As risk rises, the potential benefit to the patient must rise with it.
That sliding scale is the whole architecture of device oversight in miniature. A tongue depressor, a medical thermometer, disposable gloves and a bedpan sit at the low-risk end. At the other end are complex, high-risk devices that are implanted and sustain life: artificial hearts, pacemakers, joint replacements and CT scanners. The design of such devices constitutes a major segment of the field of biomedical engineering.
The detail that matters for cybersecurity is that a pacemaker is not a gadget with a medical label. It is a regulated, life-sustaining system whose failure mode is a patient.
How Regulation Got Here
Medical devices went unregulated in the United States until the Federal Food, Drug, and Cosmetic Act of 1938. It took another four decades for the Medical Device Amendments of 1976 to establish the regulation and oversight framework recognisable today.
Europe moved later and differently. Regulation as it is now understood came into effect in 1993 through the Medical Device Directive, which the Medical Device Regulation replaced on 26 May 2017. The dates are worth keeping in mind. Modern connected medicine, with radios in implants and apps on phones, arrived long after these frameworks were written, and regulators have been retrofitting security expectations onto them ever since.
The market those rules govern is substantial. The global medical device market was estimated at between $220bn and $250bn in 2013, with the United States holding roughly 40% of it, Europe 25%, Japan 15% and the rest of the world 20%. Germany, Italy, France and the United Kingdom lead within Europe, while Japan holds the second-largest single-country share. A large, distributed, software-heavy estate is exactly the kind of target that rewards patience.
The Vulnerabilities Are In The Software
Under the hood, the modern implant is a small computer with a radio. That is what makes remote monitoring and firmware updates possible, and it is also what puts the device in the same threat category as everything else connected.
The pattern shows up across connected health. In November the US Food and Drug Administration issued a Class 2 recall for IntelePACS, picture archiving and communication software from Intelerad Medical Systems, a GE HealthCare company, deployed globally and affecting an estimated 560 users. The agency’s 4 November notice described a vulnerability that could let a malicious user take over an administrator session, delete or modify image or study data, or lock legitimate users out, alongside a software issue that could cause unintended deletion of image data from an external archive integration. Intelerad had issued Urgent Medical Device Correction notices in September, telling customers they could keep using the system with extra cybersecurity awareness while a corrective update was implemented.
That is imaging software, not an implant, but the mechanics are the same: a trusted clinical system, a session, and data whose integrity clinicians depend on. Academic work has found comparable weaknesses closer to the patient. Researchers at Northeastern University’s Archimedes Center for Healthcare & Medical Device Cybersecurity identified 20 vulnerabilities in the Mira Ultra 4 at-home fertility tracker and its companion app, work that began as a graduate class assignment and was presented at the DefCon security conference. According to the university’s account, the flaws could permit unauthorised Bluetooth connections, access to unencrypted information and the introduction of incorrect health data, and the team reported being able to impersonate users and take over the device and app.
The researchers estimated more than 600,000 accounts could have been exposed, a figure describing potential vulnerability rather than evidence of compromise. The distinction is the technical reality of security research: demonstrating a route in identifies something that needs fixing, not proof that anyone walked through it. The students reported their findings to the FDA and the Cybersecurity and Infrastructure Security Agency, and disclosed them to manufacturer Quanovate Tech, which said in an August statement that it had identified the root cause and issued software updates. The available report does not include an independent assessment confirming every weakness was resolved.
Note what the fertility tracker case adds to the pacemaker question. False health information can cause harm independently of a privacy breach, because patients share device readings with clinicians. Integrity of data is a clinical safety property, not a privacy nicety.
How The Defences Are Built
Protective design in biomedical engineering starts from the assumption that the radio link is hostile. The engineering effort goes into constraining what a connection can do once it is made, so that a compromised phone or a spoofed clinician programmer cannot issue arbitrary commands to a device inside a chest.
Regulation supplies the forcing function. Because devices must be proven safe and effective before marketing, and because the testing burden scales with risk, the highest-risk implants face the most demanding evidence requirements of any consumer-adjacent product. Security belongs in that evidence file. The same logic that requires a life-sustaining implant to demonstrate efficacy requires its communication path to be shown resistant to takeover.
The weak point is rarely the implant’s own firmware. It is the surrounding system: the programmer in a clinic, the home monitor on a bedside table, the app on a phone, the archive server holding the images. The IntelePACS recall and the fertility tracker findings both landed in that surrounding layer. Securing an implant means securing the whole chain that touches it, which is why independent vulnerability research and rapid manufacturer correction matter as much as the silicon.
What Hybrid Warfare Means For A Cardiology Ward
State-sponsored interest in critical infrastructure is not a hypothetical for readers of this site. The same calculus that makes a payment network or a data centre a target makes a connected clinical estate attractive: disruption is cheap, attribution is slow, and the political signal is loud.
For an ordinary patient, the practical takeaway is reassuring rather than alarming. Implanted devices are regulated as high-risk products, they are designed and tested accordingly, and the security research community is actively probing connected health products for weaknesses before adversaries find them. Patients with implants should follow their clinician’s instructions on remote monitoring and device checks, and raise any concern about their device with their doctor rather than acting on internet rumour.
The wider lesson from the fertility tracker work is about trust in the data itself. Users may share tracker results with medical professionals, so confidence in the origin and accuracy of those readings is part of what the product is for. The same holds for any connected health device: a reading you cannot trust is not a reading.
What comes next is more of the same, only faster. Connected health products keep multiplying, the software supply chain behind them keeps lengthening, and the regulatory frameworks in the US and Europe keep being stretched to cover code that did not exist when they were drafted. The Archimedes Center’s DefCon presentation and the IntelePACS correction notices are the system working as intended: find the flaw, disclose it, patch it, tell the users. The measure of the next few years is whether that loop stays faster than the people probing it.
Sources
- Medical device
- Pediatric Device Showcase Highlights Software Medical Innovations
- Cybersecurity vulnerability prompts recall of popular PACS software
- 32.3 million WhatsApp users in Malaysia face malware threat
- Fertility tracker flaws highlight risks to sensitive reproductive health data
Photo: Carol M. Highsmith (Public domain)
