LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips Alice 6 sleep system has hard-coded credentials and cleartext patient data

MedDevice Cyber Staff · Mar 26 · 2 min read · Via Philips security advisory

Philips published a Responsible Disclosure advisory on March 26, 2018 for the Philips Alice 6 Polysomnography System (PSG). Philips has identified hard-coded credentials and clear text storage and transmission of patient personal health information vulnerabilities in Philips Alice 6 devices.

Philips rated the issue low risk. Sleep studies capture hours of physiological data per patient, and storing and sending that unencrypted means anyone who reaches the device or its traffic reads it. Built-in credentials make that reach easier.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Philips disclosed hard-coded credentials and cleartext PHI handling in Alice 6 PSG devices and rated it low risk. Contact Philips service for updates and keep the devices and their review workstations on an isolated network.

Isolate Alice 6 systems. Place sleep lab devices and workstations on a dedicated segment.
Request the update. Ask Philips service for software addressing the March 2018 advisory.
Encrypt data at rest. Store exported studies only on encrypted volumes.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Handles patient data

Contributing

Physiological waveform processing User accounts

Alice 6 Polysomnography System

PID-3321 PID-4112 Handles patient data User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What vulnerabilities did Philips find in the Alice 6 Polysomnography System?

Philips identified hard-coded credentials and cleartext storage and transmission of patient personal health information in Alice 6 devices, disclosed March 26, 2018.

Does the Philips Alice 6 send patient data in cleartext?

Yes. Philips disclosed that Alice 6 devices store and transmit patient personal health information in clear text, alongside hard-coded credentials.

← Back to Vulnerabilities