LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Threat Intel

Researchers found 1.2 million healthcare devices exposed online, images and all

MedDevice Cyber Staff · Aug 7 · 3 min read · Via Modat

Modat published research in August 2025, coordinated with Health-ISAC and Z-CERT, finding over 1.2 million internet-connected healthcare devices and systems reachable from the open internet. More than seventy equipment types: MRI and CT scanners, X-ray systems, DICOM viewers, hospital information systems.

Researchers could view live PHI, including brain and chest MRI images tagged with patient names and histories. The root causes were the boring ones: misconfiguration, default credentials like admin and 123456, unpatched firmware, missing authentication. Top exposure counts were the US, South Africa and Australia. This is hygiene at population scale, and the population is every connected device a health system forgot it owned.

For a manufacturer, the uncomfortable question is how many of your fielded units are in that 1.2 million because a default password was never changed. Secure defaults and forced credential rotation on setup are the cheapest fix you will ever ship.

Sources

Modat ↗

Questions & Answers

How many healthcare devices did Modat find exposed online?

Over 1.2 million internet-connected healthcare devices and systems, across more than seventy equipment types including MRI and CT scanners, X-ray systems, DICOM viewers and hospital information systems, in research coordinated with Health-ISAC and Z-CERT.

What caused the exposure of 1.2 million devices?

Ordinary hygiene failures: misconfiguration, default credentials like admin and 123456, unpatched firmware and missing authentication. Researchers could view live PHI, including MRI images tagged with patient names.

What should manufacturers take from the Modat research?

Some fraction of those 1.2 million units are fielded products still running factory defaults. Secure defaults and forced credential rotation at setup are the cheapest fix a maker can ship.

← Back to Threat Intel