A Threat Taxonomy for Hospitals and Medical Devices

Brett Crawley
Brett Crawley 18 min read
The Hospital Never Closes: a radiograph of a chest with an implanted pacemaker and its leads, with the taxonomy's title and counts.

The Hospital Never Closes: A Threat Taxonomy for Hospitals and Medical Devices

TL;DR

  • The Hospital and Medical Device Threat Taxonomy is a design-time catalogue of 221 threats in 17 suits, plus 10 structural hazards, covering the devices in, on and around the patient and the hospital systems that care depends on.
  • Every entry gives the threat, the mitigation principle a sound design follows, design measures, and mappings to STRIDE, LINDDUN, CAPEC, CWE, ATT&CK, MITRE EMB3D and the MDS2 security capabilities hospitals use when they buy devices.
  • Communications get two suits: the alarm, bleep and crash call inside the hospital, and the ambulance, radio, diversion and telehealth links outside it.
  • A red † marks direct physical harm (55 entries) and an amber † wrong or delayed treatment (101 entries).
  • It’s the reference for my Critical Condition card game, free to use for threat modeling, and available as web pages, PDF, Excel, SKOS and STIX 2.1: ostering.com/taxonomies/hospitals-and-medical-devices/

Hospitals are critical infrastructure, but they don’t behave like the rest of it. A water company can isolate a pumping station. A retailer can close its tills for a night. A hospital can’t stop, because the patients don’t. That’s the idea behind the title, and behind one of the Trumps in the taxonomy: CRI-TR-9 The hospital never closes.

This taxonomy is the reference for my Critical Condition card game. In this post I’ll explain why I think hospitals and medical devices need a design-time taxonomy of their own, what’s in it, and how to use it.

Why another list?

At first glance the space looks well covered.

  • Regulation and standards ask manufacturers to threat model their devices: the FDA’s premarket cybersecurity guidance (revised in February 2026), ANSI/AAMI SW96:2023 and IEC 81001-5-1. Hospitals have IEC 80001-1 for managing the risk of connecting devices to their networks. All of them tell you to identify threats. None of them gives you the threats.
  • MITRE EMB3D catalogues threats to embedded devices, and it’s very good. It’s written for device makers, and it stops at the device.
  • MITRE ATT&CK names adversary techniques. It describes an attack after the fact; it doesn’t tell a design team where to look.
  • Health threat catalogues, such as HITRUST’s, are built around protecting health data. Data matters, but in a hospital the worst outcome is rarely a breach.

What none of them gives a design team is the hospital as a system of systems: the monitor and the alarm path to the nurse’s handset, the integration feed that writes a result into the record, the pneumatic tube that carries the sample, the supplier who can reach every hospital in a region, and the night the network is down. In a hospital the consequence of a security failure is usually a patient who isn’t treated, or is treated wrongly. That’s what this taxonomy is organised around.

What’s in it

The taxonomy has 231 entries: 17 suits of 13 threats each, split into the game’s two decks, plus 10 structural hazards that both decks carry.

The Patient: what touches the patient

The Patient deck: a fan of three cards, CRI-IM-A, CRI-PM-K and CRI-LS-A, beside the deck's eight suits and the Trumps
  • IM · Implants and Programmers: Pacemakers, ICDs, neurostimulators, cochlear and retinal implants and implantable pumps, with the programmers, home transmitters and clouds that talk to them.
  • BW · Body-worn and Home-use Devices: Insulin pumps, CGMs and closed loops, patch and Holter ECG, pulse oximeters, BP cuffs, hearing aids and connected inhalers, and the phones that control them.
  • PM · Patient Monitoring: Bedside monitors (ECG, SpO2, NIBP and invasive BP, heart rate, respiration, capnography, temperature), central stations, telemetry and early-warning feeds.
  • LS · Life Support and Therapy: Ventilators and respirators, anaesthesia workstations, oxygen, defibrillators, dialysis, ECMO, neonatal incubators and surgical robots.
  • MD · Medication Delivery: Infusion and PCA pumps, drug libraries, pump-EHR auto-programming, barcode administration, dispensing cabinets, pharmacy robots and controlled drug records.
  • IR · Imaging and Radiation: X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine and radiotherapy, with their worklists, workstations, images and dose.
  • LD · Laboratory and Diagnostics: Analysers, LIS and middleware, point-of-care tests, blood bank, pathology and digital pathology, sequencers and outsourced lab services.
  • CA · Clinical Software and AI: Software as a medical device, decision support, dose calculators, early-warning and sepsis scores, imaging AI, AI scribes and the apps clinicians reach for.

The Hospital: what runs care

The Hospital deck: a fan of three cards, CRI-CC-A, CRI-EC-Q and CRI-FB-A, beside the deck's nine suits and the Trumps
  • RC · Records and Patient Data: The EHR and patient administration, orders and results, identity matching, sensitive categories, portals, research use and the audit trail.
  • IN · Integration and Interoperability: HL7 v2, FHIR, DICOM, integration engines, device integration middleware and regional exchange.
  • NW · Networks and Wireless: Segmentation, legacy systems inside devices, Wi-Fi, WMTS telemetry, Bluetooth, RTLS, device inventory and satellite sites.
  • CC · Clinical Communications: Nurse call, alarm routing to handsets, pagers and bleeps, DECT and Wi-Fi phones, secure and shadow messaging, crash calls, switchboard and overhead paging.
  • EC · Emergency and External Communications: Ambulance dispatch, prehospital ECG and pre-alerts, emergency services radio, diversion, image transfer, telehealth, hospital-at-home hubs, staff call-in, patient SMS and backup links.
  • FB · Facilities and Building Systems: Medical gases, theatre and isolation ventilation, backup power, cold storage, water, sterile services, pneumatic tubes, lifts, infant security and building management.
  • SV · Suppliers, Service and Lifecycle: Vendor remote service, service laptops, manufacturer clouds, patching rights, end of support, procurement evidence, refurbished devices, disposal and vendor failure.
  • AC · Identity and Access: Clinician identities, default and hard-coded credentials, shared directories, shared logins, break-glass, session handover, privileged and temporary accounts, badges.
  • CD · Continuity and Downtime: Estate-wide ransomware, shared services, backups, restore validation, downtime procedures and copies, diversion, incident communications and extortion.

Why communications get two suits

When I drafted the suits, communications kept turning up in the threats that ended worst. An alarm that never reaches a nurse, a crash call that rings nowhere, an ambulance pre-alert that arrives late or for the wrong patient. In most taxonomies they’d be a footnote under networks. Here they’re two suits: Clinical Communications for everything inside the hospital, and Emergency and External Communications for the links to the ambulance service, other hospitals and patients at home.

The ten structural hazards

These are properties of hospitals and medical devices as a whole, and in the game they’re the Trumps. Each line gives the hazard’s mitigation principle.

  1. CRI-TR-1 · Life before login. Design security so the safe and secure path is also the fastest path in an emergency.
  2. CRI-TR-2 · The device outlives its software. Plan the whole service life of a device’s software at design and at purchase.
  3. CRI-TR-3 · Nobody owns the bedside. Every connected device has a named owner for its security, across its whole life.
  4. CRI-TR-4 · Safety cases assume accidents. Treat intentional misuse as a cause of hazards in the safety risk file, not a separate concern.
  5. CRI-TR-5 · Alarm fatigue hides the attack. Alarms are few, meaningful and protected from change, so an abnormal one gets attention.
  6. CRI-TR-6 · One supplier, many hospitals. Know where many hospitals share one supplier and keep a way to work without it.
  7. CRI-TR-7 · Patch means revalidate. Design and contract for timely, validated updates as part of the device, not an exception.
  8. CRI-TR-8 · Every patient is a target. Collect, keep and expose only what care needs, and protect the most sensitive data most strongly.
  9. CRI-TR-9 · The hospital never closes. Build maintenance and recovery into the design so they do not require stopping care.
  10. CRI-TR-10 · Hospitals are strategic targets. Plan for a patient, capable adversary who wants disruption, not only for criminals who want money.

Anatomy of an entry

Anatomy of an entry: the card CRI-PM-K, Alarms silenced from afar, beside its taxonomy entry, which adds the ID, title and harm marker, threat, mitigation principle, four design measures, the card's three prompts, and mappings to STRIDE, CAPEC, CWE, ATT&CK, EMB3D, MDS2 and the IEC and ISO standards

Every entry has:

  • An ID, such as CRI-PM-K: the game prefix, the suit and the rank, joined by hyphens so it’s one searchable token. The IDs are frozen: an entry added later between two ranks takes an intermediate value, such as CRI-PM-3.1, so a published ID never changes.
  • The threat, written against the system you’re reviewing rather than against an attacker’s playbook.
  • A mitigation principle and three or four design measures. The measures are examples of what good looks like; your design may meet the principle another way.
  • Mappings to STRIDE, LINDDUN (where there’s a privacy angle), CAPEC 3.9, CWE 5.0, ATT&CK v20.0, MITRE EMB3D (for embedded devices), the MDS2 security capabilities and the standards that address the entry directly.
  • A dagger where patients can be harmed, and public cases where they show the threat in practice.

A note on rank: in the game, the Ace is the most severe threat in its suit and the 2 the least. In the taxonomy the ID is a reference, not a severity, so rate each finding on its merits in your own system.

Two daggers

I started with a single dagger for “patient safety”, like the physical-safety marker in Black Start. It ended up on two thirds of the entries, which told me it was too blunt. So there are two:

  • Red †, direct physical harm: the threat itself can injure or kill a patient, through a wrong dose, a therapy change, life support stopping or a gas supply failing. 55 entries.
  • Amber †, wrong or delayed treatment: the harm comes through information or a service failing, such as a missed alarm, a wrong result, a stale record or a delayed ambulance. 101 entries.

The rule book is strict about both. A red dagger isn’t accepted without the person who owns clinical safety for the system in the room, and an amber one needs a clinical lead’s sign-off.

Seen in the wild

Every threat in the taxonomy is a design weakness, not a news story, but 24 public cases show some of them in practice. The cases are there to show the threats are real, not to name and shame anyone, and attribution is given only where an official body made it.

  • Contec CMS8000 patient monitors, 2025 (CRI-PM-8). CISA and the FDA warned that Contec CMS8000 patient monitors made hidden connections to a hard-coded internet address, could download and run unverified files, and sent patient data in plain text when a patient was connected; with no fix available, CISA advised unplugging them. A researcher later argued it was more likely insecure design than deliberate backdoor.
  • Ascension, 2024 (CRI-EC-K, CRI-CD-A, CRI-CD-10). A ransomware attack took Ascension’s electronic health records offline across its hospitals, staff worked on paper and some ambulances were diverted; data on about 5.6 million people was taken.
  • Change Healthcare, 2024 (CRI-RC-K, CRI-CD-2, CRI-TR-6). Ransomware at Change Healthcare, which handles about one in three US health transactions, left many providers and pharmacies unable to process claims and prescriptions for weeks; the data of about 192.7 million people was taken.
  • CrowdStrike update outage, 2024 (CRI-CD-7). A faulty CrowdStrike security update crashed Windows computers worldwide; hospitals lost systems for hours and some, such as Mass General Brigham, cancelled non-urgent surgeries and visits.
  • NHS Dumfries and Galloway, 2024 (CRI-RC-K). A ransomware group stole data from NHS Dumfries and Galloway, claiming 3 TB, and published clinical data on patients to pressure the health board; the board said records were not altered and care continued.
  • Synnovis pathology attack, London, 2024 (CRI-LD-Q, CRI-CD-K, CRI-CD-10, CRI-TR-6). Ransomware at Synnovis, pathology provider to King’s College Hospital and Guy’s and St Thomas’, led to thousands of postponed operations and appointments and an appeal for O-type blood donors. In June 2025 King’s confirmed a patient had died unexpectedly during the attack, with a long wait for a blood test result among the contributing factors; the local care board reported 170 patients harmed, mostly low harm.
  • Advanced and NHS 111, 2022 (CRI-EC-A). Ransomware at software supplier Advanced disrupted the Adastra system used by NHS 111 and out-of-hours services, and exposed data on about 80,000 people. The UK Information Commissioner fined Advanced £3.07 million in March 2025.
  • Conti attack on Ireland’s HSE, 2021 (CRI-AC-Q, CRI-CD-A, CRI-CD-3). Conti ransomware encrypted about 80% of the Health Service Executive’s IT environment and about 700 GB of data was taken; the HSE shut its national IT down and took around four months to recover fully. PwC’s independent post-incident review was published in December 2021.
  • Elekta cloud outage, 2021 (CRI-IR-K, CRI-SV-Q, CRI-CD-K). Ransomware hit Elekta’s first-generation US cloud service for radiation oncology software, and about 170 US health systems were affected; some cancer centres could not treat patients for over a week because treatment programming was held in the cloud.
  • PwnedPiper pneumatic tubes, 2021 (CRI-FB-8). Armis disclosed nine vulnerabilities in Swisslog Translogic pneumatic tube system stations, used by thousands of hospitals to move samples and drugs, including unsigned firmware updates that could let an attacker take over stations.
  • Argus II retinal implant, 2020 (CRI-IM-8, CRI-SV-4, CRI-TR-2). Second Sight phased out its Argus II retinal implant and, after laying off most staff in March 2020, could no longer support its more than 350 recipients; patients were left with implants that could not be repaired and, in one case, could not get an MRI without the maker’s input.
  • MDhex, GE patient monitoring, 2020 (CRI-PM-A, CRI-PM-9). CISA published six vulnerabilities (MDhex) in GE Healthcare CARESCAPE telemetry servers, central stations and related patient monitoring products, including hard-coded credentials, that could let an attacker change alarm settings or make devices unusable.
  • SweynTooth Bluetooth flaws, 2020 (CRI-BW-8, CRI-BW-7, CRI-NW-7, CRI-SV-3). The FDA warned that SweynTooth flaws in Bluetooth Low Energy chips used in pacemakers, glucose monitors, insulin pumps and other devices could let someone nearby crash a device, stop it working or bypass security.
  • University Hospital Düsseldorf, 2020 (CRI-EC-K, CRI-CD-8). Ransomware took down systems at University Hospital Düsseldorf and it stopped taking emergency admissions; a woman sent to a hospital in another city died. Prosecutors opened a homicide inquiry but closed it, concluding her condition alone caused her death and the delay did not affect the outcome.
  • Vastaamo psychotherapy records, Finland, 2020 (CRI-RC-Q, CRI-TR-8). Therapy records of about 36,000 patients of the Vastaamo psychotherapy centre were stolen in 2018 and 2019; in October 2020, after the company refused to pay, patients were extorted individually. A Finnish court convicted the attacker in April 2024 and the appeal court upheld the conviction in 2025.
  • DICOM files carrying malware, 2019 (CRI-IR-10, CRI-IN-J, CRI-EC-9). Cylera researchers showed that the DICOM file format allows an image file to also be a working Windows executable, so malware could hide inside medical images protected as patient data (CVE-2019-11687).
  • Medtronic Conexus telemetry, 2019 (CRI-IM-A, CRI-IM-4). US government advisories warned that the Conexus radio protocol used by Medtronic implantable defibrillators, clinic programmers and home monitors had no authentication or encryption, so someone nearby could read or change device settings.
  • Medtronic MiniMed insulin pumps, 2019 (CRI-BW-A). The FDA warned that certain older Medtronic MiniMed insulin pumps could be reached over their radio link by someone nearby and their settings changed; Medtronic recalled them and offered replacements, as the pumps could not be updated.
  • Open PACS servers, 2019 (CRI-IR-5, CRI-IN-J, CRI-NW-J). Greenbone found about 590 imaging archive (PACS) servers reachable on the internet without protection, exposing records of about 24 million patients and hundreds of millions of images; an update later counted over a billion images.
  • URGENT/11, 2019 (CRI-PM-9, CRI-MD-7, CRI-NW-10, CRI-SV-3). The FDA warned that 11 vulnerabilities in IPnet, a third-party network stack inside several embedded operating systems, could let attackers take over or crash medical devices and hospital network equipment, and that manufacturers might not know their products contained it.
  • Abbott (St. Jude Medical) pacemakers, 2017 (CRI-IM-K). The FDA approved a firmware update for about 465,000 radio-enabled Abbott pacemakers in the US to stop unauthorised reprogramming; patients had to visit a clinic to have it applied, weighing a small risk of update failure.
  • WannaCry and the NHS, 2017 (CRI-IR-9, CRI-NW-A, CRI-NW-K, CRI-SV-J, CRI-AC-Q, CRI-CD-A). WannaCry ransomware disrupted at least 81 of England’s 236 NHS trusts and infected 595 GP practices; the NAO estimated over 19,000 appointments were cancelled, and some trusts diverted ambulances.
  • Leaking Beeps, 2016 (CRI-CC-10). Trend Micro research showed that pager messages sent by US hospitals were unencrypted and could be read with cheap radio equipment, exposing patient names, diagnoses and treatment details.
  • Hospira Symbiq infusion pumps, 2015 (CRI-MD-K). The FDA advised hospitals to stop using Hospira Symbiq infusion pumps because they could be accessed remotely over the hospital network and their dosing changed.

Where the other taxonomies take over

The taxonomy sits alongside the others on the Taxonomies pages, and picks them up only where they become a route into patient care or a consequence for it:

Downloads and licence

The overview page links to a page per suit, and the whole taxonomy is available as a PDF, an Excel workbook, SKOS (JSON-LD) and a STIX 2.1 bundle.

© 2026 Jonathan Brett Crawley. The taxonomy is licensed under CC BY-NC-ND 4.0 with additional permissions: you can share it freely for non-commercial purposes, threat model with it (including for paying clients), use it internally and for training in any organisation, and quote entries with credit in paid work. Shipping it in a product needs permission. The full terms are on the overview page.

Final thoughts

The taxonomy grew out of the Critical Condition card game. I built the game first, because a card on the table gets a mixed room talking in a way a document never does. The taxonomy is the other half: once the card has been played, here’s what good looks like.

It’s version 1.0, and it will grow. If you work in clinical engineering, run security for a hospital or build medical devices, and you find a threat it misses or a measure that doesn’t hold up in your world, tell me on LinkedIn.

Stay tuned!

References

You may also like: