All terms
CybersecurityConnected & Cyber-Physical Devices
Brainjacking
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026
Definition
Brainjacking is the term coined by Oxford researchers Pugh, Pycroft, Maslen, Aziz, and Savulescu (2017) for the malicious, unauthorized control of implanted neurostimulation devices - most notably deep brain stimulators (DBS) used to treat Parkinson's disease, essential tremor, dystonia, depression, and OCD. Modern DBS systems are programmed wirelessly through a clinician programmer or, increasingly, a patient remote and a smartphone app communicating over Bluetooth or proprietary RF. An attacker who can reach those programming interfaces could alter stimulation amplitude, frequency, pulse width, or contact configuration, or simply switch the device off. Documented research-level attacks against neurostimulator programming protocols (Marin et al., 2016; Halperin et al., 2008 on ICDs as a precedent) show that the underlying class of attack - eavesdropping and command injection on poorly authenticated implant telemetry - is well within reach of motivated adversaries. Because the targeted organ is the brain, the harm potential ranges from subtle behavioral and motor effects to seizures, severe pain, or cognitive change. What the regulation says
FDA's 2023 premarket cybersecurity guidance and Section 524B of the FD&C Act apply directly to neurostimulators that meet the cyber-device definition - they have software, can connect (Bluetooth/RF/programmer link), and have technological characteristics vulnerable to threats. FDA expects a documented threat model that explicitly considers unauthorized modification of therapy parameters, authenticated and encrypted programming sessions, and a postmarket vulnerability monitoring plan. ICS-CERT/CISA medical-device advisories have addressed comparable implant telemetry weaknesses (e.g., Medtronic CareLink/Conexus advisories, ICSMA-19-080-01) and set the regulatory expectation that implant programming links be cryptographically authenticated.
What this means in practice
In practice, brainjacking risk is mitigated by treating the implant-to-programmer link as untrusted by default: mutual authentication using device-unique keys provisioned at manufacture, encrypted sessions, replay protection, bounded parameter ranges enforced in firmware, and clinician-confirmed parameter changes with audible/visible feedback. Patient remotes and companion apps should hold no fleet-wide secrets and should mediate, not replace, clinician authority over therapy boundaries. Common pitfalls
- •Relying on the obscurity of a proprietary RF protocol instead of cryptographic authentication.
- •Allowing the patient remote or companion app to set stimulation parameters outside clinician-defined safe ranges.
- •Leaving the inductive or Bluetooth programming interface open whenever the device is in range, rather than requiring an explicit clinician-initiated session.
- •Treating brainjacking as a purely theoretical risk and omitting it from the device threat model.
Frequently asked questions
There is no publicly confirmed case of a patient harmed by a brainjacking attack in the wild. The term describes a credible, well-characterized threat class demonstrated in academic security research against implant telemetry, not a documented clinical incident. Regulators treat it as a risk to be designed against, not a hypothetical to be ignored.
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsCybersecurity
Hardcoded Credentials
Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device.
Cybersecurity
Medjacking
Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function.
Cybersecurity
Premarket Cybersecurity Submission
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
Cybersecurity
Section 524B of the FD&C Act(524B)
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
More in Cybersecurity
· Same categoryCybersecurity
Secure Boot
A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device.
Cybersecurity
Threat Modeling
A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
Cybersecurity
AAMI SW96
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
Cybersecurity
AAMI TIR57
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
Primary references
5 sourcesLink health: 5 verified· last checked 2026-06-20
Springer·1World Neurosurgery·1ACM·1CISA·1FDA·1
- 1
Pugh et al., 'Brainjacking in deep brain stimulation and autonomy' (Ethics and Information Technology, 2018)VerifiedSpringerlink.springer.com
- 2
Pycroft et al., 'Brainjacking: Implant Security Issues in Invasive Neuromodulation' (World Neurosurgery, 2016)VerifiedWorld Neurosurgerysciencedirect.com
- 3
Marin et al., 'On the (in)security of the latest generation implantable cardiac defibrillators' (ACSAC 2016)VerifiedACMdl.acm.org
- 4
ICSMA-19-080-01 Medtronic Conexus Telemetry ProtocolVerifiedCISAcisa.gov
- 5
FDA Cybersecurity Guidance (Sept 2023)VerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.