LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Threat Intel

Akira crossed $244 million in ransoms, with healthcare in the target set

MedDevice Cyber Staff · Nov 14 · 3 min read · Via HIPAA Journal

FBI, CISA, DC3, HHS and international partners updated the Akira ransomware advisory in November 2025. More than $244 million in ransoms collected since March 2023, with healthcare listed alongside manufacturing, education and IT.

The tradecraft is a checklist of known-and-ignored gaps: exploitation of SonicWall CVE-2024-40766 and Cisco CVE-2020-3259, VPN logins without MFA, abuse of legitimate remote tools like AnyDesk and LogMeIn, double extortion, and encryption of VMware ESXi and Nutanix AHV virtual machines. Sit with that: two of the primary entry points are a VPN missing MFA and a five-year-old Cisco CVE. The sophisticated part of ransomware is rarely the way in.

For device makers whose products live on hospital networks, the ESXi and Nutanix detail matters. When the hypervisor gets encrypted, every virtualized clinical system goes down together, including yours.

Sources

HIPAA Journal ↗

Questions & Answers

How much has Akira ransomware collected?

More than $244 million since March 2023, per the November 2025 advisory update from FBI, CISA, DC3, HHS and international partners, with healthcare among the listed target sectors.

How does Akira get in?

Known and ignored gaps: exploitation of SonicWall CVE-2024-40766 and Cisco CVE-2020-3259, VPN logins without MFA, and abuse of legitimate remote tools like AnyDesk and LogMeIn, followed by double extortion.

Why does the ESXi detail matter for device makers?

Akira encrypts VMware ESXi and Nutanix AHV virtual machines. When the hypervisor goes down, every virtualized clinical system on it goes down together, including systems a device maker ships or depends on.

← Back to Threat Intel