WASHINGTON, D.C. – Yesterday, Congressman Gary Palmer (AL-06), Chairman of the Subcommittee on Oversight and Investigations, led a hearing titled Aging Technology, Emerging Threats: Examining Cybersecurity Vulnerabilities in Legacy Medical Devices . “The health care sector is one of 16 critical infrastructure sectors in the U.S. and has become a significant target for cyberattacks. To ensure our hospitals are secure and patients safely receive the treatment they need, we must reduce the vulnerabilities found in legacy medical devices,” said Chairman Palmer. “Yesterday’s hearing helped us better understand the risks of these devices and how to navigate them.” Watch the full hearing here . Below are key excerpts from yesterday’s hearing : Congressman Gary Palmer (AL-06): “Are there updated estimates on how many legacy medical devices are currently in-use across the U.S. health care system?” Mr. Decker: “The problem is actually sort of unknown, as far as how many devices exist, especially when we start talking about the concept of what is legacy versus what is non-legacy devices… We can estimate how many devices we think exist. So, if you look inside any typical hospital, you have for any bed 8-15 some devices connected to it. There are stats that show there’s about 913,000 beds in the United States, so extrapolating that, you get to about easily 10,000,000 devices that exist.” Congressman Brett Guthrie (KY-02): “We’re talking about backdoor medical devices and what that means in the discovery and what vulnerabilities that has and how it’s concerning. So, Mr. Decker and Ms. Jump, how often do we find this type of thing?” Mr. Decker: “Within medical devices, specifically, it’s unknown. You know, there was that report that came out about the Contec Chinese device and in your opening comments, you mentioned there’s two potential opportunities for that to occur. We know that certain nation-state adversaries are prepositioning themselves into critical infrastructure and other critical infrastructure have been targeted for this, so it’s certainly within the realm of possibility that that’s occurring within health care.” Ms. Jump: “I would say that, as a risk management expert, I think that with the increased enforcement of risk management efforts, penetration testing, and threat modeling that FDA has placed on manufacturers, not only for new devices, but also for any devices going in for a significant change of modification, (so older devices do still go through this process) - that manufacturers are being forced to actually look critically at their devices across the whole spectrum - the entire threat landscape of that device. Therefore, I think that we are going to find more and more of these. Certainly, with my clients, we do threat modeling. We do penetration testing. We help those manufacturers find those issues before they become problems and start causing issues within the health care industry.” Congressman Rus Fulcher (ID-01): “Mr. Garcia, during your verbal testimony, you made a statement that surprised me a little bit and it was that the medical device security in the medical industry, if I understood you correctly, was the most targeted for cyberattacks. Did I get that right?” Mr. Garcia: “The entire health care ecosystem, not just medical devices.” Mr. Fulcher: “Okay, so why health care? I mean, we hear about the banking, right? And power grids. What is it about the health care industry that creates that target?” Mr. Garcia: “Yeah, I came from financial services before this and, at that time 15 years ago, banking was the biggest target because that’s where the money is. But then they started outspending the criminals. The problem with health care is, first off, it is a widely distributed, multifaceted ecosystem that has a lot of touch points, a lot of vulnerabilities. Secondly, there is less money to spend against cyber threats. And thirdly, it’s easy money. When you have a ransomware attack, if you are a hacker and you ransom a hospital, you are forcing the decision on the hospital: should I pay the ransom and continue to treat patients or should I not and run the risk of not treating patients and/or going out of business. That’s why.” ###