Is medjacking the same as a ransomware attack on a hospital?

No, but they often overlap. Medjacking specifically describes compromise of medical devices; ransomware crews increasingly use medjacked devices as their entry or persistence layer because those devices are weakly monitored and rarely patched.

What's the difference between medjacking and brainjacking?

Medjacking is the broad category - hijacking any medical device, usually networked hospital equipment. Brainjacking is a narrow subclass that specifically targets implanted neurostimulators such as DBS systems.

All terms

CybersecurityConnected & Cyber-Physical Devices Clinical Evidence

Medjacking

Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

Definition

Medjacking - short for medical device hijacking - was popularized by the security firm TrapX in its 2015 'MEDJACK' report and the 2016 'MEDJACK.2' and 2017 'MEDJACK.3' follow-ups, which documented attackers using out-of-date, unmanaged medical devices (blood gas analyzers, PACS workstations, infusion pumps, imaging consoles) as long-lived footholds inside hospital networks. Because medical devices often run unsupported operating systems, are exempt from routine IT patching, and live on flat clinical networks, they make ideal pivot points: an attacker who lands on a CT console can move laterally to EHRs, billing systems, or other devices while evading the endpoint detection tools deployed on standard IT assets. Medjacking can also describe direct manipulation of the device's clinical function - changing infusion pump flow rates, ventilator settings, or imaging parameters.

What the regulation says

FDA's 2023 premarket cybersecurity guidance and Section 524B of the FD&C Act push manufacturers to ship devices that resist medjacking by design: hardened OS configurations, signed firmware, network segmentation guidance for operators, coordinated vulnerability disclosure, and a postmarket plan to patch vulnerabilities throughout the supported lifetime. CISA and HHS HC3 publish operator-side guidance (network segmentation, asset inventory, clinical-network monitoring) aligned with the NIST Cybersecurity Framework and the HSCC Joint Security Plan. The FDA-led Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook (MITRE, updated 2022) is the reference response framework when a medjacking-style incident occurs.

What this means in practice

Mitigation is shared between the manufacturer and the healthcare delivery organization. Manufacturers reduce the attack surface (no default credentials, signed updates, least-privilege services, current OS, MDS2 disclosure, SBOM + VEX). Hospitals isolate clinical networks, maintain a real-time medical-device asset inventory, monitor for anomalous behavior, and follow the MITRE/FDA response playbook when devices are suspected of compromise.

Examples

An attacker compromises an old X-ray machine connected to the hospital network, then uses it to gain access to the patient management system.
A malicious actor remotely alters the dosage settings of a networked infusion pump, putting patient safety at risk.
A healthcare network experiences a breach where a compromised diagnostic imaging workstation becomes a pivot point to exfiltrate patient records from the electronic health record system.

Common pitfalls

•Shipping devices on long-out-of-support operating systems with no patching pathway.
•Assuming the hospital network is a trusted environment - it is not.
•Omitting an MDS2 form and SBOM, leaving hospital security teams unable to assess exposure.
•Treating medjacking as an IT problem rather than a joint manufacturer/operator responsibility.

Frequently asked questions

It was coined by the security firm TrapX in its 2015 'Anatomy of an Attack: Medical Device Hijack (MEDJACK)' report, which documented attackers using compromised medical devices as persistent footholds in hospital networks, with follow-up MEDJACK.2 (2016) and MEDJACK.3 (2017) reports.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

Brainjacking

Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.

Cybersecurity

Hardcoded Credentials

Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device.

Cybersecurity

Medhacking

Umbrella term for hacking activity directed at medical devices, ranging from criminal attack to coordinated security research and patient-led modification.

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

More in Cybersecurity

· Same category

Cybersecurity

Section 524B of the FD&C Act(524B)

The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

Cybersecurity

Threat Modeling

A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

Cybersecurity

AAMI SW96

AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.

Cybersecurity

AAMI TIR57

AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (2)

Latest in MedTech

Sources

4 sources

Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 3Tier 4Trade press and expert commentary· 1

Link health: 4 verified· last checked 2026-06-20

Dark Reading·1MITRE·1HHS HC3·1FDA·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Sources: 4
Updated: 9/19/2026

Compare with another term

Learn in 60 seconds

Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function.

·Mitigation is shared between the manufacturer and the healthcare delivery organization.
·Manufacturers reduce the attack surface (no default credentials, signed updates, least-privilege services, current OS, MDS2 disclosure, SBOM + VEX).
·Medjacking can also describe direct manipulation of the device's clinical function - changing infusion pump flow rates, ventilator settings, or imaging parameters.

Remember this

Watch out: Shipping devices on long-out-of-support operating systems with no patching pathway.

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.