The Global State of Internet of Healthcare Things (IoHT) Exposures on Public-Facing Networks

Censys identified 14,004 public IPs exposing healthcare devices and systems—primarily DICOM servers (36%), EMR/EHR portals (28%), PACS, and Mirth Connect instances—creating a large external attack surface for protected health information. The report contextualizes the risk with the ALPHV/BlackCat ransomware attack on Change Healthcare and Microsoft/CISA warnings about active exploitation of Mirth Connect CVEs, and recommends immediate mitigations such as MFA, VPNs/firewalls, and continuous external attack-surface monitoring.