Loading story…
A study led by Soufian El Yadmani, CEO of Modat, found 1.2 million medical devices exposed on the internet, primarily due to default credentials, weak passwords, and IT misconfigurations. The exposed devices include MRI scanners, X-ray systems, and dental equipment, putting sensitive medical data at risk. The research highlights the urgent need for healthcare organizations to strengthen device security and monitor internet-exposed assets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Industrial and building-automation environments continue to expose **operational technology (OT)** services directly to the public internet, increasing the likelihood of unauthorized access and disruption. An *Intelligence-Driven Active Defense Report 2026* cited by Palo Alto Networks/Siemens/Idaho National Laboratory data indicates internet exposure is growing sharply, with *Cortex Xpanse* reporting **110M+ observations** of exposed OT devices in 2024 and fingerprinting **19.6M unique OT devices/services** across **1.77M IPv4 addresses**; the highest concentrations were observed in the **US, China, and Germany**. Frequently observed exposed products included **Tridium Niagara**, **Linear eMerge**, and **Saia PCD Web Server**, and common exposure points included standard web ports `TCP/443` and `TCP/80` alongside OT/building-automation-associated ports such as `TCP/502`, `UDP/47808`, and Niagara-related ports like `TCP/4911` and `TCP/5011`. Similar internet-exposure risk was observed in healthcare, where Rapid7 Labs reported **30+ UK-based systems** responding to **DICOM** requests over `TCP/104` (the default medical imaging port) from the public internet. Rapid7 stated it used *Project Sonar* to validate service responsiveness only and did not attempt to access records, but warned that externally reachable DICOM services—especially without VPN restriction or encryption—are readily discoverable via routine scanning and were not designed for hostile networks. Prior research cited in the report indicates misconfigured or poorly controlled **PACS/DICOM** deployments can leak sensitive metadata (including patient identifiers) and may be susceptible to data reconstruction or modification, creating both **cybersecurity** and **patient safety** risk.
Jun 29, 2026
Authorized security assessments at hospitals uncovered serious weaknesses that allowed a red teamer to access restricted patient information through both physical and network paths. By posing as a new staff member, wearing scrubs, using a fake badge, and building rapport with a nurse by complaining about a real doctor, the tester was allowed past an electronic lock and a human gatekeeper into a medical records room, where he retrieved a target patient file and demonstrated how easily trust could override access controls. A separate assessment found guest Wi-Fi effectively shared exposure with critical medical systems on `VLAN 1`, leaving devices including MRI machines visible from less trusted networks and transmitting sensitive patient data without encryption. The findings indicate that some healthcare environments continue to prioritize operational speed, uptime, and data flow over stronger security hygiene, increasing the risk of unauthorized access to restricted areas and private medical records.
Jul 24, 2026
Internet-facing medical-imaging deployments running **Orthanc PACS** administrative consoles and **OHIF** web viewers were found exposed through HTTP/S interfaces, creating potential access to sensitive imaging records. Passive scanning identified 414 reachable Orthanc consoles and 700 OHIF viewers; in the United States, 36 of 91 identified Orthanc consoles—about 40%—accepted access without an authentication challenge, while 43 were protected and 12 could not be conclusively classified. The exposure is linked to insecure deployment defaults, including reuse of a canonical OHIF-Orthanc Docker configuration. **CVE-2025-0896** documents that Orthanc does not enable authentication by default when remote access is enabled. The exposed systems appear more likely to belong to smaller self-hosted radiology and pathology practices than enterprise hospital environments, underscoring the need to restrict public access, require authentication, and review internet-exposed DICOM and imaging-management services.
Sep 23, 2026