The Cybersecurity and Infrastructure Security Agency said Medtronic reported a cyber breach of a vulnerability in its Paceart Optima System, which compiles and manages patients' cardiac device data.

WHY IT MATTERS

According to Medtronic's advisory, the vulnerability is in an enabled optional messaging feature in the Paceart Messaging Service and healthcare organizations should work with Medtronic technical support to install the update to the Paceart Optima application, which will eliminate this vulnerability from the application server.

In the advisory, CISA provided steps that can be taken immediately for some configurations. 

The agency also urged health systems and providers to minimize network exposure for all control system devices by taking them offline – particularly for organizations running a combined application and integration server – to reduce the risks of remote code execution or a denial-of-service condition. 

CISA also suggested using secure virtual private networks when remote access is required.

THE LARGER TREND

Last year, the FBI issued a report offering recommendations to address a number of cybersecurity vulnerabilities in active medical devices.

Beyond impacting healthcare facility operations, patient safety, data confidentiality and integrity, cyberattacks on medical devices can result in inaccurate readings, drug overdoses or other dangers to patient health.

Equipment vulnerable to cyberattacks includes insulin pumps, intracardiac defibrillators, mobile cardiac telemetry, pacemakers and intrathecal pain pumps, the FBI noted in its report.

The FBI has warned the healthcare sector about DDoS attack vulnerabilities for connected devices since 2017 with the anticipated explosion of connected devices. 

"Deficient security capabilities, difficulties in patching vulnerabilities and a lack of consumer security awareness provide cyber actors with opportunities to exploit these devices," the agency said.

ON THE RECORD

"If a healthcare delivery organization has enabled the optional Paceart Messaging Service in the Paceart Optima system, an unauthorized user could exploit this vulnerability to perform remote code execution and/or denial-of-service attacks by sending specially crafted messages to the Paceart Optima system," CISA said in the advisory.

Andrea Fox is senior editor of Healthcare IT News.
Email: afox@himss.org
Healthcare IT News is a HIMSS Media publication.