Fiction can spark awareness, but real-world vulnerabilities are increasingly well-documented. In medical device cybersecurity, fiction and reality influence each other continually. For instance, a 2012 ‘Broken Hearts’ episode of the hit American TV show “Homeland” the Vice President is murdered through remote access to his implantable cardioverter-defibrillator (ICD), which is programmed to deliver a fatal electric shock1,2. Feasible? Just about. In the real world the first peer-reviewed report of the cybersecurity vulnerabilities of ICDs was published in 20083, but attacks relate to data privacy and integrity, and not to lethal shock delivery. However, the TV episode inspires a real-world ethical hacker, who recreated the attack4. Our market surveillance reveals a worrying wave of similar fatalities, all, it must be noted, are fictional.

In a twist inspired by both fact and fiction, a 2016 investigation by a cybersecurity research firm and a ‘due diligence-based investment firm’ (sometimes known as a ‘short seller firm’) published a report showing that cardiac implantable electronic devices from a major manufacturer were vulnerable to ‘battery drain’ and ‘crash’ attacks5, including through a universal code that could allow hackers to control the implants5. Even though an independent cybersecurity research firm is not able to reproduce clinically significant attacks6, the report results in a substantial fall in stock price of the manufacturer, Abbott Laboratories (ex St. Jude Medical Inc.). Cybersecurity is addressed by a US Congressional committee7, and the FDA acknowledges that some of the devices can be hacked8,9, and the first ever recall related to cybersecurity, affecting 500,000 devices5,10. A firmware upgrade is announced, that is not without risk10,11. Similar vulnerabilities have been shown in insulin pumps12,13,14 and many other safety critical devices, but the story is not new, and cybersecurity is known to be a never ending war of attrition between technology developers and administrators, and networks and hackers. Although this is an interesting News story, it is largely headlines of a decade ago - what happens next?

As the internet of medical things grows and develops its character has changed

In the decade since the described ICD cybersecurity vulnerabilities were revealed an ecosystem of Remote Patient Monitoring (RPM) has emerged, including Hospital-at-Home approaches15 that leverage wearables and IoMT devices, and healthcare is beginning to shift from a facility-based model to a patient-home-centered approach16. From connected pulse oximeters to smart insulin pumps, IoMT devices are becoming the digital backbone of modern care, enabling continuous data collection, real-time analytics, and automated intervention. Recognizing the importance of this transformation, the FDA has launched its Health Care at Home Initiative17,18, an ambitious effort to ensure that at-home medical technology is seamlessly integrated into a secure, patient-friendly ecosystem. During this decade, the nature of IoMT devices themselves has changed greatly. In 2015 the IoMT was dominated by expensive implanted devices, manufactured largely by leading US and European corporations using specifically designed and self-developed platform architectures19, e.g. with early connected implants having proprietary bedside transmitters that sent data via phone line or network20. By 2025 IoMT devices are becoming dominated by relatively cheap Chinese manufactured disposable, or short-lifetime Bluetooth devices, with platform architectures that overlap consumer electronics21.

The plot takes a turn, and the supply chain becomes a serious geopolitical concern

Recent incidents underscore real-world vulnerabilities within global supply chains, including examples of devices compromised during manufacturing to cause intentional harm22,23. This showcased the security vulnerabilities of the supply chain and the dramatic effect of its successful infiltration.

Prior to such events, cybersecurity concerns had been dominated by software vulnerabilities24, and where hardware concerns were raised, these were dominated by concerns over the supply chain of the critical core internet architecture, and the potential for malign foreign powers to insert backdoors. The nature of the highly targeted on-person attacks drew attention to the possibility of supply chain cybersecurity vulnerabilities of the everyday devices that have become commonplace in all our homes and pockets. Concerns were recently voiced in the UK parliament, with warnings regarding Chinese-manufactured components in smart devices which could serve as undetected entry points for sabotage and cyberattacks25.

Hardware exploits in critical systems show that our hardware really is spying on us

As the nature of medical devices and their supply chains change, so does the nature of cybersecurity vulnerabilities. In early 2025 the US Cybersecurity and Infrastructure Security Agency (CISA) released a notice of the vulnerability codenamed CVE-2024-1224826. This vulnerability relates to the Contec CMS8000 patient monitor, a device used in hospitals to monitor a patient’s vital parameters. Contec Medical Systems is a global medical device and healthcare solutions company headquartered in China, and its medical equipment is used in hospitals, clinics, and home healthcare environments in the EU and the US27. Alarmingly, the vulnerability in the device has been classified as a ‘backdoor’, which allows for what is known as remote code execution, even though there has not been attribution of malicious intent27,28. This enables the complete manipulation of the device by a remote actor, and possibly also their control or influence on other devices in the network. Considering the patient monitor’s use case, which is either in a hospital or in a Hospital-at-Home setting, successful exploitation of this backdoor could lead to catastrophic outcomes for a patient, from suppressing alarms in an emergency to actively manipulating the data, preventing an emergency from being detected in the first place29.

The security challenges in medical device supply chains

The uptake and success of remote patient monitoring and the Hospital-at-Home model rely on an increasingly complex ecosystem of connected medical devices. Whether provided as part of an integrated suite or incorporated through a “bring your own device” (BYOD) model30,31, these platforms depend on a global supply chain that spans multiple manufacturers, component suppliers, and software vendors30. This interdependence introduces inherent security risks, many of which remain poorly understood or inadequately addressed.

What makes these vulnerabilities so difficult to mitigate is the complexity and opacity of modern supply chains. A single medical device may contain hundreds of components, sourced from dozens of suppliers across different countries. In many cases, original equipment manufacturers rely on third-party suppliers for microchips, memory modules, and wireless communication components—many of which pass through little or no security verification before being integrated into finished medical devices.

This creates an environment where backdoors—either through design flaws or through intentional security weaknesses - can be introduced at any stage, often without the knowledge of the device manufacturers themselves. The result is an invisible attack surface, one that remains embedded within critical healthcare infrastructure long before the first vulnerability is ever detected. As the described cases demonstrate, hardware supply chain compromises in devices are not hypothetical—they are already happening.

Regulating to secure the IoMT supply chain

The vulnerabilities in medical hardware—whether pre-installed backdoors, compromised firmware, or supply chain infiltration—highlight the urgent need for stronger cybersecurity measures in the IoMT. The EU’s Cyber Resilience Act32 introduces mandatory cybersecurity requirements for digital products. It enforces security throughout a device’s lifecycle, supply chain controls, and long-term security updates, but does not apply to medical devices. In their case, the Medical Device Regulation (MDR)33 has similar, albeit less explicit, requirements for medical devices34. In the US, the Federal Food, Drug, and Cosmetic Act (FD&C Act)35 defines high-level cybersecurity requirements, such as to monitor and address postmarket vulnerabilities or to provide a software bill of materials (SBOM)36.

Technical advancements to secure the IoMT supply chain

Beyond regulation, technical safeguards are critical (Fig. 1). A secure foundation that can be implemented during the first stages of manufacturing, through an approach known as a Root of Trust. Here, hardware supply chain security is ensured through embedding a secure chip, such as an eSIM or a Trusted Platform Module (TPM), which is soldered onto the device’s circuit board. This serves to protect devices by preventing unauthorized software changes through cryptographic checks. An eSIM provides secure storage of cryptographic credentials, primarily used for authenticating a device within a cellular or network environment, and facilitates secure cryptographic operations related to identity verification. However, it does not directly ensure system software integrity. In contrast, a TPM is specifically designed to enhance device integrity. TPMs enable devices to securely store cryptographic keys and perform integrity checks by recording cryptographic hashes (measurements) of each component loaded during the boot process. TPMs allow systems to attest remotely that they are running only authorized and correctly signed software by securely reporting these measurements after boot. Improving visibility into the device supply chain by using systems that track individual components and automatically detect risks is also critical.

Fig. 1: Threats and mitigations across the IoMT supply chain.
figure 1

A selection of threats and mitigations in the IoMT with (a) showing possible avenues of attack emerging along a device’s supply chain and (b) showing a set of possible mitigations.

Full size image

A secure software architecture can be facilitated through the concept of “Secure by Design”. In this approach, software subsystems are isolated according to the “Principle of Least Authority” to reduce the impact of vulnerabilities37. For example, software managing patient data should not have unnecessary permissions, such as controlling network settings, to minimize harm if compromised.

Modular chips, called chiplets, can achieve similar isolation among components from different suppliers at the hardware level. Employing these security best practices in design and implementation, along with formal verification methods for security-critical components, is paramount.

Once deployed in a hospital or the HaH the security can be increased by adopting Zero Trust security models38, where devices and users are continuously authenticated and network access is segmented. Employing these security best practices in design and implementation, along with formal verification methods for security-critical components, is paramount. In short, a holistic security architecture needs to be applied in the development and life cycle of an IoMT product.

Summary

IoMT medical devices of a decade ago, largely manufactured in the US and the EU, had vulnerabilities related to naive design and the lack of consideration of the potential for malicious actors to target patients. There is now clear and present danger of profit motivated or malicious cybersecurity attacks on EU and US healthcare systems39. Although personally targeted malicious or profit motivated attacks on individuals are not common, modern IoMT supply chains have weaknesses that can enable such attacks. As a response to geopolitical risks the EU and US are investing in semiconductor independence and tightening procurement policies to reduce reliance on high-risk vendors. One aspect of these risks is the accidental or intentional supply chain weaknesses or attacks with the inclusion of backdoors in hardware. As IoMT adoption accelerates, ensuring security requires both regulatory enforcement and proactive industry safeguards. In the EU, the MDR33 & Cyber Resilience Act32 provides a foundation, and in the US FD&C Act35. However, manufacturers and healthcare providers must act now to protect hardware, firmware, and network integrity before vulnerabilities become active threats.

Thus, manufacturers must proactively embed robust security measures, such as Roots of Trust and Zero Trust architectures, from the earliest stages of medical device manufacturing to protect against invisible threats hidden deep within the complex global supply chains, while regulators must urgently expand and clarify cybersecurity requirements in medical device regulations to enforce transparent, comprehensive security standards34 (Table 1).

Table 1 Next steps for industry and policymakers
Full size table