Active exploitation, ransomware activity, and incident reporting across clinical environments.
Cook Medical disclosed on August 13 that a social engineering attack on July 2 gave an outside party access to customer contact information, employee names and emails, Salesforce communication records, and internal business files. The company says it contained the access the same day and found no evidence that protected data was reached.
The Coalition for Health AI convened a cybersecurity work group of nearly 100 members on August 12. A defensive playbook, an offensive playbook, and a frontier AI risk assessment tool are due by end of 2026. Health-ISAC and Johns Hopkins sit on the council of 14.
Second-quarter revenue grew 9.4 percent, but the beds business is still digging out from the March outage and the backlog will not reach a manageable level until the end of the third quarter.
Abbott disclosed unauthorized access to a limited number of internal systems in its cancer diagnostics business, months after closing the $21 billion Exact Sciences acquisition. It has not said what was taken.
Two months after an 8-K disclosed unauthorized access to corporate IT systems, Medtronic began notifying affected people. The company reports no product, patient safety or manufacturing impact and no sign of the data online.
Roche published its response to the FortiBleed exposure of roughly 75,000 internet-facing Fortinet firewalls, assessing its environment and reporting no product impact. The advisory itself is the point.
A social engineering attack on third-party-hosted applications exposed patient health information and company data, followed by a payment demand. Device systems and clinical operations stayed clean.
First-quarter sales grew 2.6 percent against a March attack that wiped 40,000 laptops and stalled shipping for weeks. One analyst put the miss near $317 million. The full-year outlook did not move.
The FBI IC3 2025 report recorded 278 ransomware complaints from healthcare, the most of any critical infrastructure sector, and flagged a troubling uptick in AI-enabled cybercrime.
Forescout's 2026 Riskiest Connected Devices report added medication dispensing systems, medical image printers and DICOM gateways, and found healthcare has the highest prevalence of legacy Windows of any sector.
Stryker identified a cyberattack on March 11. Researchers say the attacker used admin access to Microsoft Intune to push wipe commands across phones and workstations, and CISA wants every operator to harden that layer now.
Intuitive Surgical said an unauthorized third party got at customer business and contact information along with employee and corporate data after a phishing incident.
UFP Technologies, which makes components and finished devices for medtech OEMs, is investigating a cyberattack that touched company data and warned of short-term shipment delays.
Health-ISAC counted 455 ransomware incidents against healthcare in 2025, named Qilin, INC Ransom and SafePay among the most active, and reported executives rank AI-enabled attacks as the top emerging concern.
An updated FBI and CISA advisory put Akira ransomware proceeds past $244 million since 2023, detailing VPN logins without MFA and encryption of VMware ESXi and Nutanix virtual machines.
CISA issued Emergency Directive 26-01 after F5 disclosed a nation-state actor had stolen BIG-IP source code and undisclosed vulnerability data. The AHA told hospitals to act, calling the gear ubiquitous in healthcare.
Anthropic disclosed an operation where an attacker used an AI coding agent to automate reconnaissance, intrusion, data theft and ransom notes against at least 17 organizations, including healthcare.
Modat, working with Health-ISAC and Z-CERT, found over 1.2 million internet-connected healthcare devices exposed online. Some served live MRI and chest images tagged with patient names.
The patient monitoring company said the attack that hit its ability to fulfill orders will not stop fulfillment going forward and will not move its updated outlook.
Philips warned that malware is circulating impersonating its legitimate DICOM Viewer software. Not a product flaw, a brand-impersonation threat that turns your download page into an attacker channel.