Censys recently published a new research report that looks at exposed data on the internet involving healthcare devices and systems connected to PHI. Here’s their Executive Summary:
- Censys discovered 14,004 unique IP addresses exposing healthcare devices and data systems connected to potentially sensitive medical information on the public internet. These exposures greatly raise the risk of unauthorized access and exploitation. This figure likely reflects the lower bound of the total risk, as many more devices may be exposed but not publicly visible..
- Nearly 50% of the exposed hosts (6,884) are located in the United States, followed by 10.5% (1,476) in India. This is likely due to both countries having large, complex healthcare infrastructure that serves large populations, where organizations must handle vast amounts of sensitive data. Comparatively, we detected only 200 publicly available hosts in the United Kingdom, possibly a reflection of its more centralized healthcare infrastructure.
- Open DICOM ports and DICOM-enabled web interfaces intended for exchanging and viewing medical images account for 36% of the exposures, with 5,100 hosts publicly exposing these systems. This is concerning because DICOM is a legacy protocol with several known security weaknesses.
- EMR/EHR systems, which store and manage electronic health records, represent the second-largest exposure type at 28% with 4,031 interfaces publicly available. The exposure of the login interfaces to these systems potentially puts vast amounts of sensitive personal health data, including medical histories and social security numbers at risk.
- Healthcare organizations must prioritize securing their internet-exposed assets that handle sensitive patient data, particularly DICOM and EMR/EHR systems. This includes strengthening access controls, enforcing multi-factor authentication, and ensuring proper configurations in both cloud and on-premise environments to protect sensitive medical data.
Read more at Censys.