By Vincentas Baubonis, Head of Security Research at Cybernews
The recent discovery of a backdoor in the Contec CMS8000 patient monitor – revealed by CISA – should be a wake-up call for anyone in the cybersecurity or healthcare sectors. This is not a rare, isolated issue.
A report by the US Government Accountability Office (GAO) highlighted that, as of January 2022, 53% of connected medical devices and other Internet of Things devices in hospitals had known critical vulnerabilities, emphasizing the widespread nature of this problem.
These findings indicate that many of the devices we rely on in healthcare are very vulnerable. Specifically, the CMS8000 backdoor allows remote access, potentially enabling attackers to manipulate vital signs monitoring or leak sensitive patient data without detection. And as terrifying as this case is, it’s just one example of a much broader, deeply ingrained problem.
Let’s talk numbers. According to the Cybernews Business Digital Index, the healthcare industry is performing terribly when it comes to cybersecurity. A full 22% of analyzed healthcare companies scored a D in security, and nearly half – 48% – earned an F. Only 5% of the sector’s organizations reached an A. With an average security score of just 69, healthcare comes in dead last when it comes to cybersecurity. That should make everyone in this field sit up and take notice.
The reality is, medical devices like the Contec CMS8000 aren’t being designed with the security they require. With more and more devices connecting to the internet and sharing sensitive data, this is a ticking time bomb. Healthcare organizations are failing to enforce the most basic security measures. In the worst cases, manufacturers are shipping devices with poorly coded firmware that’s vulnerable to remote manipulation – leaving hospitals, doctors, and patients exposed. Devices bought by critical sectors should be evaluated technically before acquisition and potential risks associated with them must be managed and mitigated by the buyer.
Medical devices like the Contec CMS8000 often lack essential security features, making them vulnerable to cyber threats. As more devices connect to the internet and handle sensitive patient data, the risks increase significantly. Reports from regulatory agencies, including the FDA and CISA, have repeatedly highlighted security flaws in medical devices, including vulnerabilities that allow remote access and data exposure.
In some cases, manufacturers ship devices with outdated or insecure firmware, exposing healthcare providers and patients to potential cyberattacks. To mitigate these risks, healthcare organizations must enforce stricter security evaluations before procurement, ensuring that all devices meet established cybersecurity standards and that identified vulnerabilities are promptly addressed.
Medical devices need to be treated with the same rigor as any other critical infrastructure. But far too often, the focus is on getting the device to market quickly, not securing it properly. This oversight has immediate consequences: data breaches, privacy violations, and, in the worst cases, loss of life.
So, what needs to happen now? First and foremost, cybersecurity must be baked into the design and testing of every medical device. Manufacturers must adopt a security-first mindset, regularly updating their devices and using secure coding practices to eliminate these vulnerabilities before they hit the market. Healthcare providers, too, must take ownership by ensuring their networks are secure and implementing strong access controls on all connected devices.
This is not a problem that can be solved with band-aid fixes. It’s time for a fundamental shift. If the healthcare industry doesn’t start prioritizing cybersecurity across the board, incidents like the CMS8000 backdoor will continue to be just the tip of the iceberg, especially against the backdrop of rising state-backed cyberattacks.
ABOUT THE EXPERT
Vincentas Baubonis is an expert in Full-Stack Software Development and Web App Security, with a specialized focus on identifying and mitigating critical vulnerabilities in IoT, hardware hacking, and organizational penetration testing. As Head of Security Research at Cybernews, he leads a team that has uncovered significant privacy and security issues affecting high-profile organizations and platforms such as NASA, Google Play, and PayPal. Under his leadership, the Cybernews team conducts over 7,000 pieces of research annually, publishing more than 600 studies each year that provide consumers and businesses with actionable insights on data security risks.
SafePay Claims To Have Pwned Conduent
Posted in Commentary with tags Hacked on February 21, 2025 by itnerdRansomware gang SafePay has today claimed responsibility for a January 2025 cyber-attack against IT giant Conduent. The outage disrupted electronic money transfers and EBT payments made by its clients, which include half of Fortune 100 companies, for two days.
Paul Bischoff, Consumer Privacy Advocate at Comparitech had this comment:
“Ransomware attacks can lock down computer systems and steal confidential data. If the targeted company doesn’t pay a ransom, then it faces extended downtime, data loss, an putting customers at increased risk of fraud.”
“SafePay’s attack on Conduent is the first confirmed ransomware attack on a US tech firm in 2025, though Comparitech researchers have logged 36 unconfirmed claims so far this year.”
“In 2024, we tracked 12 confirmed ransomware attacks on US tech companies, which was a significant decline from 2023’s 44 confirmed attacks. We counted 104.4 million records compromised in 2023, compared to just 1.9 million in 2024.”
“One of the biggest such attacks in 2024 was against ITSG, which notified 900,000 people of an October data breach claimed by ransomware gang BianLian.”
Additionally, Comparitech researchers reached out to Conduent and received a statement in response, which can be found at this link: https://www.comparitech.com/news/another-ransomware-gang-says-it-breached-it-giant-conduent/
Leave a comment »