Loading story…
Healthcare sector experts said medical device cybersecurity may become more manageable as manufacturers provide more complete software bills of materials (SBOMs) and hospitals improve asset visibility. Phil Englert of Health-ISAC said that when vulnerabilities such as SweynTooth emerge, organizations with better device component inventories can more quickly identify affected systems, and he pointed to U.S. FDA rules in effect since 2023 that require medical device makers to include SBOMs for commercial, open-source, and off-the-shelf components in premarket submissions for covered "cyber devices."
Englert said higher-quality, more consistent SBOM data, combined with evolving AI-enabled tools, should help healthcare delivery organizations and manufacturers streamline vulnerability identification and resilience efforts across medical device environments. The reporting is based on the same HIMSS 2026 interview carried by two outlets, while separate commentary on systemic third-party risk in healthcare tied to the Change Healthcare ransomware incident addresses a different issue and does not describe the same specific development in medical device security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
At the HIMSS 2026 conference in Las Vegas, Phil Englert of Health-ISAC said broader sharing and better use of SBOMs are improving hospitals' and manufacturers' ability to identify affected devices and respond to newly disclosed vulnerabilities such as SweynTooth. He also said higher-quality SBOMs combined with evolving AI-enabled tools should make medical device vulnerability management and resilience easier over time.
U.S. Food and Drug Administration regulations effective in 2023 began requiring medical device makers to include software bills of materials for cyber devices in pre-market submissions, covering commercial, open-source, and off-the-shelf components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are moving beyond traditional vulnerability management and treating software transparency as a core security requirement, with **Software Bills of Materials (SBOMs)** becoming central to software supply chain defense. Reporting on preparations for the EU **Cyber Resilience Act (CRA)** says manufacturers of products with digital elements will be required to create, maintain, and when necessary provide inventories of software components, driving broader adoption of SBOM tooling and automation. The shift is intended to improve visibility into open-source libraries and third-party dependencies so teams can identify vulnerable packages, assess supplier risk, and respond faster to newly disclosed flaws. Security practitioners are also pushing companies to use SBOMs as an operational tool rather than a compliance document. Group-IB researcher Anastasia Tikhonova said organizations should apply SBOM data continuously for vulnerability triage, vendor access reviews, identity monitoring, and incident response, as modern supply chain attacks increasingly link phishing, ransomware, and data breaches through inherited trust relationships. She warned that attackers’ use of AI is compressing attack timelines from weeks to minutes, increasing the need to prioritize exposed systems, define compromise windows, contain stolen credentials, and score vendor risk by access level and potential blast radius.
Jul 10, 2026
Healthcare organizations remain under sustained cyber pressure, with **764 incidents reported in 2025** versus 749 the previous year, according to French health-sector reporting cited by *ZDNet*. A national survey of healthcare executives found that **15% of facilities** said they had experienced a cyber incident causing disruption since 2022, while leadership concerns in a crisis center on **continuity of care**, financial impact, and staff working conditions. The reporting indicates cyber risk is now treated as a governance issue rather than only a technical one, but resource constraints and the need to strengthen hospital information systems remain major obstacles. Germany’s **BSI** separately warned that software security in the healthcare sector is still inadequate after testing standard configurations of several medical and practice-management applications. In that review, **three of four** examined practice management systems contained chains of weaknesses that could have enabled **internet-based attacks**, including the use of outdated encryption algorithms; vendors were notified and reportedly remediated the issues. A separate *ZDNet* article about manipulation of online payment flows at Spanish hotels concerns a **different incident** in the payment sector and is not part of the healthcare story.
Jun 29, 2026
The Health Sector Coordinating Council (HSCC) has released Version 2 of its Model Contract-Language for Medtech Cybersecurity, designed to help healthcare providers and medical device manufacturers better define and share cybersecurity responsibilities in procurement contracts. The updated framework addresses the increasing complexity and connectivity of medical devices, many of which now leverage internet connectivity and artificial intelligence, raising the stakes for robust cybersecurity measures in healthcare environments. This new version incorporates feedback from stakeholders on the initial 2022 release, clarifies shared risk and accountability between device makers and healthcare delivery organizations, and aligns contract language with evolving regulatory requirements. The revised model aims to reduce ambiguity in contract negotiations, ensuring that cybersecurity considerations are explicitly addressed and that both parties understand their obligations to protect patient safety and sensitive data.
Jun 29, 2026