--- title: "Medjacking, Definition | MedTech Terms" description: "Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/medjacking#term", "name": "Medjacking", "alternateName": "Medical device hijacking", "description": "Medjacking - short for medical device hijacking - was popularized by the security firm TrapX in its 2015 'MEDJACK' report and the 2016 'MEDJACK.2' and 2017 'MEDJACK.3' follow-ups, which documented attackers using out-of-date, unmanaged medical devices (blood gas analyzers, PACS workstations, infusion pumps, imaging consoles) as long-lived footholds inside hospital networks. Because medical devices often run unsupported operating systems, are exempt from routine IT patching, and live on flat clinical networks, they make ideal pivot points: an attacker who lands on a CT console can move laterally to EHRs, billing systems, or other devices while evading the endpoint detection tools deployed on standard IT assets. Medjacking can also describe direct manipulation of the device's clinical function - changing infusion pump flow rates, ventilator settings, or imaging parameters.", "url": "https://medtechterms.com/terms/medjacking", "termCode": "medjacking", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/medjacking#article", "headline": "Medjacking", "description": "Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function.", "url": "https://medtechterms.com/terms/medjacking", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/medjacking" }, "about": { "@id": "https://medtechterms.com/terms/medjacking#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Medjacking, Medical device hijacking, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "TrapX MEDJACK.2 (2016) coverage", "url": "https://www.darkreading.com/cyberattacks-data-breaches/medjack-2-old-malware-used-in-new-medical-device-hijacking-attacks", "publisher": { "@type": "Organization", "name": "Dark Reading" } }, { "@type": "CreativeWork", "name": "Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook (MITRE, 2022)", "url": "https://www.mitre.org/news-insights/publication/medical-device-cybersecurity-regional-incident-preparedness-and-response", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "HHS HC3 Threat Briefs - Medical Device Security", "url": "https://www.hhs.gov/about/agencies/asa/ocio/hc3/index.html", "publisher": { "@type": "Organization", "name": "HHS HC3" } }, { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/brainjacking#term", "name": "Brainjacking", "url": "https://medtechterms.com/terms/brainjacking" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/medhacking#term", "name": "Medhacking", "url": "https://medtechterms.com/terms/medhacking" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hardcoded-credentials#term", "name": "Hardcoded Credentials", "url": "https://medtechterms.com/terms/hardcoded-credentials" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Medjacking", "item": "https://medtechterms.com/terms/medjacking" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/medjacking#faq", "mainEntity": [ { "@type": "Question", "name": "Where does the term 'medjacking' come from?", "acceptedAnswer": { "@type": "Answer", "text": "It was coined by the security firm TrapX in its 2015 'Anatomy of an Attack: Medical Device Hijack (MEDJACK)' report, which documented attackers using compromised medical devices as persistent footholds in hospital networks, with follow-up MEDJACK.2 (2016) and MEDJACK.3 (2017) reports." } }, { "@type": "Question", "name": "Is medjacking the same as a ransomware attack on a hospital?", "acceptedAnswer": { "@type": "Answer", "text": "No, but they often overlap. Medjacking specifically describes compromise of medical devices; ransomware crews increasingly use medjacked devices as their entry or persistence layer because those devices are weakly monitored and rarely patched." } }, { "@type": "Question", "name": "What's the difference between medjacking and brainjacking?", "acceptedAnswer": { "@type": "Answer", "text": "Medjacking is the broad category - hijacking any medical device, usually networked hospital equipment. Brainjacking is a narrow subclass that specifically targets implanted neurostimulators such as DBS systems." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Medjacking [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Clinical Evidence](/ecosystems/clinical-evidence) # Medjacking Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Medjacking - short for medical device hijacking - was popularized by the security firm TrapX in its 2015 'MEDJACK' report and the 2016 'MEDJACK.2' and 2017 'MEDJACK.3' follow-ups, which documented attackers using out-of-date, unmanaged medical devices (blood gas analyzers, PACS workstations, infusion pumps, imaging consoles) as long-lived footholds inside hospital networks. Because medical devices often run unsupported operating systems, are exempt from routine IT patching, and live on flat clinical networks, they make ideal pivot points: an attacker who lands on a CT console can move laterally to EHRs, billing systems, or other devices while evading the endpoint detection tools deployed on standard IT assets. Medjacking can also describe direct manipulation of the device's clinical function - changing infusion pump flow rates, ventilator settings, or imaging parameters. What the regulation says FDA's 2023 premarket cybersecurity guidance and [Section 524B of the FD&C Act](/terms/section-524b) push manufacturers to ship devices that resist medjacking by design: hardened OS configurations, signed firmware, network segmentation guidance for operators, [coordinated vulnerability disclosure](/terms/cvd), and a postmarket plan to patch vulnerabilities throughout the supported lifetime. CISA and HHS HC3 publish operator-side guidance (network segmentation, asset inventory, clinical-network monitoring) aligned with the [NIST Cybersecurity Framework](/terms/nist-csf) and the [HSCC Joint Security Plan](/terms/hscc-jsp). The FDA-led Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook (MITRE, updated 2022) is the reference response framework when a medjacking-style incident occurs. ## What this means in practice Mitigation is shared between the manufacturer and the healthcare delivery organization. Manufacturers reduce the attack surface (no default credentials, signed updates, least-privilege services, current OS, [MDS2](/terms/mds2) disclosure, [SBOM](/terms/sbom) + [VEX](/terms/vex)). Hospitals isolate clinical networks, maintain a real-time medical-device asset inventory, monitor for anomalous behavior, and follow the MITRE/FDA response playbook when devices are suspected of compromise. Common pitfalls - • Shipping devices on long-out-of-support operating systems with no patching pathway. - • Assuming the hospital network is a trusted environment - it is not. - • Omitting an MDS2 form and SBOM, leaving hospital security teams unable to assess exposure. - • Treating medjacking as an IT problem rather than a joint manufacturer/operator responsibility. ## Frequently asked questions Where does the term 'medjacking' come from? It was coined by the security firm TrapX in its 2015 'Anatomy of an Attack: Medical Device Hijack (MEDJACK)' report, which documented attackers using compromised medical devices as persistent footholds in hospital networks, with follow-up MEDJACK.2 (2016) and MEDJACK.3 (2017) reports. Is medjacking the same as a ransomware attack on a hospital? What's the difference between medjacking and brainjacking? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking)[ Cybersecurity Hardcoded Credentials Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device. ](/terms/hardcoded-credentials)[ Cybersecurity Medhacking Umbrella term for hacking activity directed at medical devices, ranging from criminal attack to coordinated security research and patient-led modification. ](/terms/medhacking)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity) ### More in Cybersecurity · Same category [ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling)[ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57) Cited by Where this term appears across MedTech Terms. Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Clinical Evidence](/ecosystems/clinical-evidence) ## Primary references 4 sources Link health: 4 verified · last checked 2026-06-20 Dark Reading· 1 MITRE· 1 HHS HC3· 1 FDA· 1 1. [1 TrapX MEDJACK.2 (2016) coverage Verified Dark Reading · darkreading.com ](https://www.darkreading.com/cyberattacks-data-breaches/medjack-2-old-malware-used-in-new-medical-device-hijacking-attacks) 2. [2 Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook (MITRE, 2022) Verified MITRE · mitre.org ](https://www.mitre.org/news-insights/publication/medical-device-cybersecurity-regional-incident-preparedness-and-response) 3. [3 HHS HC3 Threat Briefs - Medical Device Security Verified HHS HC3 · hhs.gov ](https://www.hhs.gov/about/agencies/asa/ocio/hc3/index.html) 4. [4 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 4 Updated 5/5/2026 [Compare with another term](/compare?a=medjacking) Learn in 60 seconds Card Lesson Quiz Compromise of a networked medical device to use it as a foothold inside a hospital network or to manipulate clinical function. - · Mitigation is shared between the manufacturer and the healthcare delivery organization. - · Manufacturers reduce the attack surface (no default credentials, signed updates, least-privilege services, current OS, MDS2 disclosure, SBOM + VEX). - · Medjacking can also describe direct manipulation of the device's clinical function - changing infusion pump flow rates, ventilator settings, or imaging parameters. Remember this Watch out: Shipping devices on long-out-of-support operating systems with no patching pathway. Related terms - [Brainjacking ](/terms/brainjacking) - [Medhacking ](/terms/medhacking) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [Threat Modeling ](/terms/threat-modeling) - [Hardcoded Credentials ](/terms/hardcoded-credentials) You may also need Auto-suggested from Cybersecurity and shared keywords. - [AAMI TIR57 ](/terms/aami-tir57) - [SOC 2 ](/terms/soc-2) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) - [Hardware Root of Trust(HRoT) ](/terms/hardware-root-of-trust) - [Health Information Sharing and Analysis Center(H-ISAC) ](/terms/h-isac) - [ISO/IEC 27001(ISO 27001) ](/terms/iso-27001) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)