Cyberattacks on Pacemakers: Could Hackers Control Life-Saving Medical Devices?

Key points

Modern pacemakers use wireless links for remote monitoring, which creates a cyberattack surface on a device that keeps patients alive.
In 2017, U.S. regulators approved a cybersecurity firmware update for hundreds of thousands of Abbott (formerly St. Jude Medical) pacemakers after researchers found exploitable vulnerabilities.
No confirmed malicious pacemaker attack has caused a death, but researchers have shown settings changes and battery depletion are possible, so device makers and hospitals must treat these devices as critical cyber assets.

As healthcare increasingly embraces digital transformation, a new category of cyber risk is emerging—one that goes far beyond financial losses, data breaches, or operational disruptions. Modern healthcare systems now depend heavily on connected medical devices that directly influence patient health and survival. Among these devices, pacemakers represent one of the most critical and sensitive targets for potential cyberattacks.

Millions of patients worldwide rely on pacemakers to regulate abnormal heart rhythms and maintain normal cardiac function. Traditionally, these devices operated in isolation. Today, however, many pacemakers are connected through wireless communication technologies that enable physicians to monitor patients remotely, adjust device settings, and receive real-time performance data.

While these technological advancements have improved patient care, they have also created a new cybersecurity challenge. If a malicious actor gains unauthorized access to a connected medical device, the consequences could extend far beyond the theft of information. In extreme scenarios, cyberattacks against pacemakers could interfere with life-sustaining functions, potentially endangering human lives.

According to CA Mayur Joshi, digital threats researcher, forensic technology specialist, and member of EC-Council’s Global Advisory Board for Computer Forensics, cyber risks associated with healthcare devices deserve far greater public attention than they currently receive.

In his series examining emerging digital threats, Joshi identifies connected medical devices as one of the most overlooked attack surfaces in modern cybersecurity. While financial institutions, governments, and corporations routinely discuss cyber resilience, the cybersecurity implications of medical technologies often remain outside mainstream public discussion despite their direct connection to patient safety.

“Cybersecurity is no longer only about protecting information. Increasingly, it is about protecting human lives. As medical devices become smarter and more connected, the security of these devices becomes a matter of patient safety rather than merely information security,” notes Mayur Joshi.

Why Pacemakers Have Become a Cybersecurity Concern

Pacemakers are specialized medical devices implanted into the chest to regulate irregular heart rhythms. They continuously monitor cardiac activity and deliver electrical impulses whenever required to maintain proper heart function.

For many patients, pacemakers are not optional devices. They are essential medical technologies that enable normal day-to-day life and reduce the risk of serious cardiac complications.

Modern pacemakers increasingly rely on wireless communication capabilities that allow healthcare providers to monitor patient conditions remotely. These remote monitoring features help physicians identify potential issues quickly, reduce unnecessary hospital visits, and improve patient outcomes.

However, connectivity introduces risk, the same risk behind other cyberattacks that can endanger human lives.

Any device connected to a network potentially becomes a target for cyber attackers. Just as hackers attempt to compromise computers, smartphones, industrial systems, or banking networks, connected medical devices may also become targets if vulnerabilities are discovered.

The concern is not theoretical. Security researchers have repeatedly demonstrated that vulnerabilities can exist within medical devices and their supporting infrastructure. Although no confirmed malicious attack causing death through a hacked pacemaker has been reported, cybersecurity experts have consistently warned that the possibility cannot be ignored.

The 2017 Pacemaker Recall That Changed the Industry

One of the most significant cybersecurity incidents involving medical devices occurred in 2017 when approximately 465,000 pacemakers in the United States needed a cybersecurity firmware update, approved by the FDA, after vulnerabilities were identified.

Researchers discovered that attackers using commercially available equipment could potentially gain unauthorized access to certain devices. The vulnerabilities created concerns that a malicious actor might be able to alter device settings or prematurely drain battery life.

Although no evidence suggested that patients had actually been harmed through cyber exploitation, regulators and manufacturers acted proactively to reduce the risk.

The incident demonstrated an important reality: cybersecurity vulnerabilities in medical devices are not science fiction. They are genuine engineering and risk-management challenges requiring continuous monitoring and improvement.

According to Mayur Joshi, the 2017 recall represented a turning point for healthcare cybersecurity because it forced manufacturers, regulators, hospitals, and patients to acknowledge that connected medical devices must be treated as critical cyber assets.

Can a Hacker Really Control a Pacemaker?

One of the most frequently asked questions regarding medical device cybersecurity is whether hackers can actually take control of a pacemaker.

The answer is nuanced.

While cybersecurity researchers have demonstrated vulnerabilities under controlled conditions, successful real-world exploitation would require significant technical expertise, proximity in some scenarios, and the ability to overcome multiple layers of security controls.

Nevertheless, cybersecurity professionals evaluate risk not only by what has happened but also by what could happen if vulnerabilities remain unaddressed.

Potential attack scenarios discussed by researchers include:

Unauthorized modification of device settings
Interruption of communications between device and physician
Premature battery depletion
Manipulation of telemetry information
Denial-of-service attacks affecting device functionality

Even if such attacks remain unlikely today, the increasing sophistication of cybercriminal groups means that healthcare organizations cannot afford complacency.

Lessons from Other Healthcare Cyberattacks

The healthcare sector has already experienced multiple cyber incidents that demonstrate the vulnerability of critical systems.

The WannaCry ransomware outbreak severely disrupted healthcare services across several countries, affecting hospital operations and patient care. Numerous healthcare institutions have also experienced ransomware attacks targeting clinical systems, patient records, and operational infrastructure.

While these incidents did not directly compromise pacemakers, they revealed how dependent healthcare delivery has become on digital technologies.

That dependence extends to electricity: hospitals and patients with home medical devices are directly exposed when cyberattacks on power grids cause blackouts.

As healthcare ecosystems become more interconnected, cybersecurity weaknesses in one area may create broader risks elsewhere.

This evolving threat landscape is precisely why experts such as Mayur Joshi advocate for stronger cybersecurity governance across the healthcare sector.

What Healthcare Organizations Must Do

According to cybersecurity specialists, protecting connected medical devices requires a multi-layered approach involving:

Secure device design
Continuous vulnerability testing
Regular software updates
Strong authentication controls
Network segmentation
Regulatory oversight
Cybersecurity-by-design principles

Healthcare organizations must view cybersecurity as a patient-safety issue rather than solely an IT issue.

Manufacturers, regulators, hospitals, physicians, and patients all have roles to play in maintaining the security of connected medical devices.

Conclusion

Pacemakers represent one of the clearest examples of how cybersecurity and patient safety are becoming inseparable. While no confirmed cyberattack has yet caused a fatal pacemaker incident, the increasing connectivity of medical devices demands proactive risk management.

Through his research on emerging digital threats, CA Mayur Joshi continues to highlight the importance of preparing for risks before they become crises. His analysis of connected healthcare technologies serves as a reminder that the next frontier of cybersecurity may not involve protecting data alone—it may involve protecting the devices that keep people alive.

As healthcare continues its digital transformation journey, securing connected medical devices will remain one of the most important cybersecurity challenges of the coming decade.

Frequently asked questions

Can a hacker control a pacemaker?

Researchers have demonstrated vulnerabilities under controlled conditions, including changing device settings and draining batteries. A real-world attack would require significant expertise and, in some scenarios, physical proximity, and no confirmed malicious attack has caused a death.

What happened with the 2017 pacemaker cybersecurity update?

In August 2017 regulators approved a firmware update for Abbott (formerly St. Jude Medical) radio-frequency-enabled pacemakers after vulnerabilities were found that could let an attacker with commercially available equipment alter settings or deplete the battery. Patients received the update at a clinic visit.

How can connected medical devices be protected?

Through secure device design, continuous vulnerability testing, regular software updates, strong authentication, network segmentation, regulatory oversight and treating cybersecurity as a patient-safety issue.

Sources

Last reviewed: 21 October 2026 by CA Mayur Joshi.