Epidemic: Researchers Find Thousands of Medical Systems Exposed to Hackers

Researchers demonstrated at DerbyCon that searches using Shodan uncovered approximately 68,000 medical devices and clinical systems exposed to the public Internet — including PACS, MRI, infusion pumps and GE Healthcare systems — many accessible via default or vendor-documented credentials (they found ~130 credential sets and weak passwords like "bigguy"). Back-end storage often lacked proper permissions, enabling easy file access; combined with common physical access opportunities and phishing, these exposures create high risk for patient data theft, network pivoting and long-term attacker persistence, while remediation is slow due to device lifecycles and approval processes.