From medicine to ambulances, how the Iran war is exposing U.S. health care vulnerabilities

The Lifenet network, built by medical technology company Stryker, is a system emergency crews use to transmit a patient’s electrocardiogram to a receiving hospital while an ambulance is still en route. For a patient having a heart attack, that transmission is what activates a hospital’s cardiac catheterization lab before the patient arrives. In cardiac crises, minutes matter, and on March 11 in Maryland paramedics across the state discovered that their cardiac monitoring system had gone dark.

The cause was not a storm or a power failure. It was a full-scale attack for which an Iran-linked hacking collective called the Handala group claimed responsibility. Once inside the Microsoft Intune environment, the hackers claim to have remotely erased data from 200,000 devices across the company’s operations in 79 countries. The Maryland emergency medical services agency advised clinicians to revert to radio consultations, according to CNN. Stryker, however, said some EMS providers had temporarily paused the system “as a precaution” and that it “was not disrupted by the cyber incident.”

Stryker—a multibillion-dollar medical technology company whose equipment is embedded in hospitals and ambulances across the United States—confirmed a “global network disruption” and filed a regulatory disclosure stating that the timeline for full restoration was unknown. The company said it had “no indication of ransomware or malware” and that the investigation was ongoing. Handala stated the attack was retaliation for the February 28, US airstrike on a school in Minab, Iran, that killed at least 168 people, CNN reported. Handala picked a potentially strategic target: Stryker holds a $450 million contract with the Defense Logistics Agency to supply patient monitoring equipment to the US military.

Read more at Bulletin of the Atomic Scientists