--- title: "Medhacking, Definition | MedTech Terms" description: "Umbrella term for hacking activity directed at medical devices, ranging from criminal attack to coordinated security research and patient-led modification." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/medhacking#term", "name": "Medhacking", "alternateName": [ "Medical device hacking", "Medhack" ], "description": "Medhacking is an informal umbrella term for hacking activity directed at medical devices and clinical systems. It covers three overlapping populations: (1) malicious actors attacking devices to harm patients, extort hospitals, or pivot into healthcare networks (overlapping with medjacking); (2) security researchers performing coordinated vulnerability disclosure under programs aligned with the FDA-recognized ISO/IEC 29147 and 30111 standards; and (3) patient and DIY communities modifying their own devices for clinical benefit - most visibly the #WeAreNotWaiting movement that built open-source automated insulin delivery systems (OpenAPS, Loop, AndroidAPS) on top of commercial insulin pumps and CGMs. The term is not a regulatory category; it is a shorthand the press, conference circuit (DEF CON Biohacking Village), and patient communities use to describe the broader phenomenon of technical intervention into medical devices outside the manufacturer's intended pathway.", "url": "https://medtechterms.com/terms/medhacking", "termCode": "medhacking", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/medhacking#article", "headline": "Medhacking", "description": "Umbrella term for hacking activity directed at medical devices, ranging from criminal attack to coordinated security research and patient-led modification.", "url": "https://medtechterms.com/terms/medhacking", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/medhacking" }, "about": { "@id": "https://medtechterms.com/terms/medhacking#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Medhacking, Medical device hacking, Medhack, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "ISO/IEC 29147:2018 Vulnerability Disclosure", "url": "https://www.iso.org/standard/72311.html", "publisher": { "@type": "Organization", "name": "ISO/IEC" } }, { "@type": "CreativeWork", "name": "ISO/IEC 30111:2019 Vulnerability Handling Processes", "url": "https://www.iso.org/standard/69725.html", "publisher": { "@type": "Organization", "name": "ISO/IEC" } }, { "@type": "CreativeWork", "name": "DEF CON Biohacking Village Device Lab", "url": "https://www.villageb.io/", "publisher": { "@type": "Organization", "name": "Biohacking Village" } }, { "@type": "CreativeWork", "name": "FDA Safety Communication on Unauthorized Automated Insulin Dosing Systems (2019)", "url": "https://www.fda.gov/medical-devices/safety-communications/fda-warns-against-use-unauthorized-devices-diabetes-management", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "HSCC Medical Device and Health IT Joint Security Plan", "url": "https://healthsectorcouncil.org/the-joint-security-plan/", "publisher": { "@type": "Organization", "name": "HSCC" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/medjacking#term", "name": "Medjacking", "url": "https://medtechterms.com/terms/medjacking" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/brainjacking#term", "name": "Brainjacking", "url": "https://medtechterms.com/terms/brainjacking" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvd#term", "name": "Coordinated Vulnerability Disclosure", "alternateName": "CVD", "url": "https://medtechterms.com/terms/cvd" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Medhacking", "item": "https://medtechterms.com/terms/medhacking" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/medhacking#faq", "mainEntity": [ { "@type": "Question", "name": "Is medhacking illegal?", "acceptedAnswer": { "@type": "Answer", "text": "It depends on which branch. Malicious attacks on devices are crimes under the Computer Fraud and Abuse Act and equivalents abroad. Coordinated security research under a published disclosure policy is legal and increasingly safe-harbored. Patients modifying their own devices occupy a gray zone - it is unapproved use under FDA's framework but is not, in itself, criminally prosecuted." } }, { "@type": "Question", "name": "What is the relationship between medhacking, medjacking, and brainjacking?", "acceptedAnswer": { "@type": "Answer", "text": "Medhacking is the broad umbrella. Medjacking is the malicious subset - hijacking medical devices, often networked hospital equipment. Brainjacking is a narrow subclass of medjacking targeting implanted neurostimulators." } }, { "@type": "Question", "name": "Should manufacturers engage with the DEF CON Biohacking Village?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. The Biohacking Village Device Lab operates with FDA participation and is the most efficient public venue to surface and remediate device vulnerabilities under coordinated disclosure. Most leading MedTech manufacturers now participate." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Medhacking [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # Medhacking Umbrella term for hacking activity directed at medical devices, ranging from criminal attack to coordinated security research and patient-led modification. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Medhacking is an informal umbrella term for hacking activity directed at medical devices and clinical systems. It covers three overlapping populations: (1) malicious actors attacking devices to harm patients, extort hospitals, or pivot into healthcare networks (overlapping with [medjacking](/terms/medjacking)); (2) security researchers performing [coordinated vulnerability disclosure](/terms/cvd) under programs aligned with the FDA-recognized ISO/IEC 29147 and 30111 standards; and (3) patient and DIY communities modifying their own devices for clinical benefit - most visibly the #WeAreNotWaiting movement that built open-source automated insulin delivery systems (OpenAPS, Loop, AndroidAPS) on top of commercial insulin pumps and CGMs. The term is not a regulatory category; it is a shorthand the press, conference circuit (DEF CON Biohacking Village), and patient communities use to describe the broader phenomenon of technical intervention into medical devices outside the manufacturer's intended pathway. What the regulation says Regulators do not use 'medhacking' as a formal term, but they address its three branches separately. Malicious activity is handled through FDA safety communications, CISA medical-device advisories, and FBI/HHS cyber notifications. Coordinated security research is encouraged: FDA's 2023 cybersecurity guidance and the HSCC Medical Device and Health IT Joint Security Plan call for manufacturers to operate a [coordinated vulnerability disclosure](/terms/cvd) program aligned with ISO/IEC 29147 and 30111, and the DEF CON Biohacking Village Device Lab is run with explicit FDA participation. Patient self-modification (e.g., open-source AID) is unapproved use; FDA's 2019 safety communication on unauthorized AID systems sets the regulator's position. ## What this means in practice For manufacturers, the practical implication is to plan for all three populations: a hardened device, a published [coordinated vulnerability disclosure](/terms/cvd) policy and security.txt, an active relationship with the security research community (Biohacking Village, ICS-CERT, [MDIC](/terms/mdic)), and clear [labeling](/terms/labeling) and human-factors design that anticipate motivated patient modification - especially in chronic-disease devices like insulin pumps and CGMs. Common pitfalls - • Treating all medhackers as adversaries and lacking a coordinated vulnerability disclosure channel. - • Threatening security researchers with legal action instead of triaging their findings - a known reputational disaster in MedTech. - • Ignoring patient-driven modification trends until they become a safety communication. - • Conflating medhacking, medjacking, and brainjacking in internal risk documentation - regulators expect precise language. ## Frequently asked questions Is medhacking illegal? It depends on which branch. Malicious attacks on devices are crimes under the Computer Fraud and Abuse Act and equivalents abroad. Coordinated security research under a published disclosure policy is legal and increasingly [safe](/terms/safe-note)\-harbored. Patients modifying their own devices occupy a gray zone - it is unapproved use under FDA's framework but is not, in itself, criminally prosecuted. What is the relationship between medhacking, medjacking, and brainjacking? Should manufacturers engage with the DEF CON Biohacking Village? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking)[ Cybersecurity Coordinated Vulnerability Disclosure(CVD) A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers. ](/terms/cvd)[ Cybersecurity Medjacking Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function. ](/terms/medjacking)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity) ### More in Cybersecurity · Same category [ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 6 sources Link health: 6 verified · last checked 2026-06-20 FDA· 2 ISO/IEC· 2 Biohacking Village· 1 HSCC· 1 1. [1 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 2. [2 ISO/IEC 29147:2018 Vulnerability Disclosure Verified ISO/IEC · iso.org ](https://www.iso.org/standard/72311.html) 3. [3 ISO/IEC 30111:2019 Vulnerability Handling Processes Verified ISO/IEC · iso.org ](https://www.iso.org/standard/69725.html) 4. [4 DEF CON Biohacking Village Device Lab Verified Biohacking Village · villageb.io ](https://www.villageb.io/) 5. [5 FDA Safety Communication on Unauthorized Automated Insulin Dosing Systems (2019) Verified FDA · fda.gov ](https://www.fda.gov/medical-devices/safety-communications/fda-warns-against-use-unauthorized-devices-diabetes-management) 6. [6 HSCC Medical Device and Health IT Joint Security Plan Verified HSCC · healthsectorcouncil.org ](https://healthsectorcouncil.org/the-joint-security-plan/) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 6 Updated 5/5/2026 [Compare with another term](/compare?a=medhacking) Learn in 60 seconds Card Lesson Quiz Umbrella term for hacking activity directed at medical devices, ranging from criminal attack to coordinated security research and patient-led modification. - · For manufacturers, the practical implication is to plan for all three populations: a hardened device, a published coordinated vulnerability disclosure policy and security. Remember this Watch out: Treating all medhackers as adversaries and lacking a coordinated vulnerability disclosure channel. Related terms - [Medjacking ](/terms/medjacking) - [Brainjacking ](/terms/brainjacking) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) You may also need Auto-suggested from Cybersecurity and shared keywords. - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [Manufacturer Disclosure Statement for Medical Device Security(MDS2) ](/terms/mds2) - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [HITECH Act(HITECH) ](/terms/hitech-act) - [ICS Medical Advisory(ICSMA) ](/terms/ics-medical-advisory) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)