Implantable Orthopedic Device Maker Reports Hack

A California maker of implantable orthopedic gear is the latest medical device maker in recent weeks to disclose it’s been a victim of a cybersecurity incident.

See Also: Reduce Cloud Risk in Healthcare with Security by Default

The breach disclosure on Friday by TriMed – a maker of surgically implanted hardware to repair or replace damaged or broken joints, comes at the heels of several other medical device maker hacks including an Iranian hacktivist attack earlier this month on Stryker, a Michigan-based medtech firm, and a data theft incident reported to federal authorities in late February by UFP Technologies, a Massachusetts-based maker of single-use medical devices and other healthcare supplies.

TriMed said it launched an investigation quickly upon detecting suspicious activity on certain IT systems in 2025, determining that the company had been the victim of a cybersecurity incident. TriMed did not disclose when it discovered the unusual IT systems activities, but its investigation found that certain files were potentially accessed or acquired without authorization during an eight-day period between Sept. 13 and Sept. 21, 2025.

The compromised files included order forms and invoices that may have contained information related to the medical device hardware and individuals who received the products.

In some instances, the documents included personal information such as names, dates of birth, medical record numbers and details related to implant parts ordered on their behalf.

That includes type of device part, associated installation components such as screws, or the ordering surgeon’s name. Social Security numbers, personal bank account and personal credit card data were not compromised in the incident, TriMed said.

TriMed has not yet publicly disclosed the number of people affected by the breach and did not immediately respond to ISMG’s request for additional details about the incident.

TriMed said it reported the incident to law enforcement and is taking steps to enhance its data security. “These efforts include strengthening existing security controls and threat detection practices, as well as integrating a global security operations center, all designed to help prevent this type of incident from recurring in the future,” the company said.

High-Profile Attacks

Medical device developers and manufacturers often handle troves of sensitive data, ranging from intellectual property such as product designs, as well as client information and patient information, often making these companies attractive targets for hackers and other cybercriminals.

IT systems disruptions of the organization can also sometimes result in supply-chain issues downstream, especially if an incident interrupts product manufacturing or shipments to hospitals or the patients that need the devices as part of surgery or other treatments.

In recent weeks, the March 11 attack on Stryker by Iranian hacktivist group Handala – which is widely suspected of being a front for Iranian intelligence – claimed responsibility for the attack and boasted that it permanently deleted more than 12 petabytes of Stryker data and stole 50 terabytes of data. (see: Stryker Cyber Incident Contained, Restoration Continues).

Stryker has not publicly commented on Handala’s claims, but in a statement to ISMG on Tuesday said “strong progress” is being made on restoring the underlying systems that support production and fulfillment.

“Notably, electronic ordering systems have been restored for customers, and we are working as quickly and safely as possible to reconcile orders, manufacture products and deliver to our customers so they can continue to provide seamless patient care. This is a 24/7 effort and the first priority of our entire organization,” Stryker said.

Styker also said it’s working closely with its global manufacturing sites as operations steadily improve toward full capacity. “Manufacturing capability is quickly ramping with most of our sites and critical lines restored,” Stryker said.

Stryker said that it’s in proactive contact with the White House National Cyber Director, FBI, CISA, DHA, HHS and Health-ISAC about the incident. Stryker said it “appreciates their ongoing support, including efforts to seize domains linked to the purported threat actors. Protecting the healthcare ecosystem against cyberthreats requires extensive public-private partnership.”

U.S. federal agents on March 19 seized four web domains associated with Iranian hacking operations days after threat actor Handala posted screenshots it said came from inside the IT systems of Stryker (see: FBI Seizes Iranian Online Leak Sites After Stryker Hack).

Besides those attacks, medical device maker UFP Technologies in late February notified the U.S. Securities and Exchange Commission of a cyber incident discovered on Valentine’s Day that involved the theft or destruction of some company data (see: Medical Device Maker Reports Data Theft Hack to SEC).

UPF did not immediately respond to ISMG’s requests for an update on the status of its cyber incident.

Attacks on critical supply chain players in the healthcare sector, such as device manufacturers, can pose considerable potential problems for medical care providers and their patients, experts said.

“Third-party risk is arguably the biggest risk that hospitals and health systems face,” said Scott Gee, deputy national cyber risk adviser at the American Hospital Association. “While we may not be able to eliminate third-party risk entirely, it is critical that third-party providers work with hospitals to develop contingency plans to minimize the impact to healthcare delivery if a third-party supplier is unable to deliver much-needed supplies.”

Taking Action

Medical device makers must take steps to better defend themselves against the kinds of cyber incidents that can lead to serious disruptions, said Axel Wirth, chief security strategist at medical device security firm MedCrypt.

“On a technical level medical device manufacturers need to follow best practices to separate the varying systems – administrative, financial, production, remote hosting, etc. – so that a compromise of one does not lead to the compromise of the others – or force a preventative shutdown to prevent spillover,” he said.

Critical operational areas – such as production but also climate control – need to be architected following established best practices, such as the Purdue Model for cyber microsegmentation, he said.

“There are also security monitoring systems in the market that specifically monitor medical device or operational – such as SCADA – traffic,” he said. Also, medical device makers should plan for redundancies and fallback measures. “Keeping the lights on and recovering quickly are essential objectives.”