So far, medical devices affected in ransomware attacks have mostly been a casualty of IT networks being brought offline during incident response. But the potential nightmare scenario is a targeted device attack in which cybercriminals threaten to kill patients unless a ransom is paid, said Dr. Eric Liederman, CEO of consulting firm CyberSolutionsMD and recently retired longtime director of medical informatics at Kaiser Permanente.
“How about ransoming an organization by an attacker that is intentionally killing patients?” as Hackers could threaten to shut off ventilators of intensive care unit patients, control infusion pumps to administer fatal doses of chemotherapy, or change the settings of radiation oncology equipment to deliver a deadly amount of radiation to cancer patients, he said.
“We really haven’t seen this in this country yet, but it’s all possible,” he said in an interview with Information Security Media Group during the Healthcare Information and Management Systems Society 2025 conference in Las Vegas, Nev.
“If that were to happen, then we’d be talking about endpoint devices used as vectors of targeted attacks to extract ransom or maybe to kill off specific individuals who are in the hospital,” he said.
“There is so much that’s possible. We need to be thinking as much as we can as if we were in the shoes of an attacker, and then prepare.”
“It’s absolutely critical to think about what needs to happen to avoid chaos that kills patients,” he said.
In this audio interview with Information Security Media Group (see audio link below photo), Liederman also discussed:
- Bolstering cyber resiliency in the healthcare sector to protect patient safety;
- Overcoming hurdles that hamper cyber resiliency and response;
- Cyberattack trends involving cybercriminal gangs and nation-state actors.
Liederman, an internal medicine physician, is founder and CEO of consulting firm CyberSolutionsMD LLC. He served as director of medical informatics for The Permanente Medical Group and national leader of privacy, security and IT Infrastructure for The Permanente Federation. In these and other roles at Kaiser Permanente during his nearly 20 years at the organization, Liederman was accountable for privacy and security, IT investment, large program governance and IT infrastructure delivery and resilience.