Healthcare Cyberattacks Disrupt Pacemaker Remote Monitoring, Expose Millions of Patient Records

Boston Scientific, a medical-device maker, said the cyberattack on its IT systems remains ongoing and has affected the activation of remote monitoring communicators for new cardiac rhythm management implants implanted after August 25. The company stated that available device data will not be transmitted to remote patient management systems until the communicators are activated. Specifically, new pacemakers and other heart devices cannot provide remote monitoring, and insertable cardiac monitors (ICMs) cannot pair with the patient mobile app. However, the devices will still record episodes, and patients can transmit data via in-person interrogation using the Clinic Assistant app. The company has no timeline for full restoration but is working to partially restore shipping of some products this week. The attack also impacted manufacturing, shipping, and ordering. Boston Scientific has hired CrowdStrike for investigation and said the breach was limited to certain on-premise systems, with no further unauthorized activity seen since August 25.

Separately, pharmaceutical and medical supply giant McKesson confirmed a data breach on Saturday after ShinyHunters told The Register it had broken into the company's Snowflake and Salesforce instances and stolen millions of patients' data. McKesson's executive VP and CIO, Francisco Fraga, stated that unauthorized access to certain third-party applications and data exfiltration was associated with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The company has not disclosed the number of affected patients or the specific data stolen. McKesson supports about 3,300 oncology providers across 29 states. The company said distribution centers remain operational and product shipping continues.

Why This Matters

Patient safety is directly at risk: Boston Scientific's breach disables remote monitoring for new heart implants, potentially delaying critical medical data transmission.
The McKesson breach exposes millions of patient records, raising concerns about medical identity theft and privacy violations.
These incidents underscore the vulnerability of healthcare infrastructure, where cyberattacks can have life-or-death consequences beyond financial loss.

Background

Healthcare organizations have become prime targets for cybercriminals due to the sensitive nature of medical data and the criticality of operations. Ransomware attacks and data breaches have plagued hospitals, pharmaceutical firms, and medical device manufacturers in recent years. The Boston Scientific and McKesson incidents are part of a broader trend of cyberattacks disrupting healthcare services, with attackers often exploiting cloud-based systems and third-party applications.

Key Perspectives

Patients and Healthcare Providers: Patients with new implants face uncertainty about device monitoring, while providers may lack remote data needed for timely care. The McKesson breach could expose patients to fraud and identity theft. Boston Scientific and McKesson: Both companies are prioritizing restoration and investigation, with Boston Scientific working with CrowdStrike and McKesson assessing the breach scope. They face potential regulatory scrutiny and litigation. Cybersecurity Experts: The attacks highlight the need for robust security in medical devices and third-party integrations. The involvement of ShinyHunters suggests a financially motivated actor, but the lack of ransomware confirmation in the Boston Scientific case leaves questions unanswered.

What to Watch

Boston Scientific's timeline for restoring remote monitoring and shipping capabilities.
McKesson's disclosure of the number of affected patients and the nature of stolen data.
Potential regulatory actions from agencies like the FDA or HHS regarding patient safety and data protection.
Whether ShinyHunters leaks the stolen data or demands a ransom.

ZOTPAPER