Healthcare has rapidly adopted telemedicine to expand patient access, reduce costs, and improve care delivery. Remote consultations, connected medical devices, and digital collaboration platforms have become standard practice. While this shift has improved patient access and operational efficiency, it has also expanded the attack surface that healthcare organizations must secure.
One area that remains consistently overlooked is unmanaged Internet of Things devices within remote clinical environments. Devices such as printers, scanners, routers, and other connected peripherals are often deployed quickly to support remote care. These devices frequently operate outside traditional IT oversight.
The incident illustrated in the attached scenario highlights a very real risk within modern telehealth environments. A remote printer operating with default credentials was compromised and used as an entry point into a healthcare environment. The result was a HIPAA violation and exposure of protected health information.
This type of incident is not theoretical. Security researchers and regulatory bodies have repeatedly documented similar breaches involving poorly secured IoT devices.
This article breaks down how incidents like this occur, why they often go undetected, and what healthcare organizations must do to prevent them.
The Expanding Telemedicine Attack Surface
Telemedicine relies on distributed infrastructure. Physicians and clinicians often operate from home offices or small satellite locations. These environments contain a mix of corporate devices and consumer hardware.
The problem is visibility.
Healthcare security teams typically manage laptops, servers, and electronic health record systems. However, they often have little visibility into the other devices connected to remote networks.
Printers, webcams, home routers, and smart devices are commonly connected to the same network as clinical systems. If these devices are compromised, they can be used to observe network traffic, pivot to other devices, or intercept sensitive data.
According to the US Department of Health and Human Services Office for Civil Rights, healthcare organizations must protect electronic protected health information under the HIPAA Security Rule through administrative, physical, and technical safeguards. Failure to secure systems that process or transmit PHI can lead to reportable breaches and regulatory penalties.
Reference
US Department of Health and Human Services. HIPAA Security Rule.
https://www.hhs.gov/hipaa/for-professionals/security/index.html
How Default Credentials Create Immediate Risk
The attack vector in this scenario involved a remote printer operating with default credentials.
Default credentials are one of the most common and well documented vulnerabilities in connected devices. Manufacturers often ship devices with preset usernames and passwords to simplify setup. If these credentials are not changed during deployment, the device becomes extremely easy to compromise.
The US Cybersecurity and Infrastructure Security Agency warns that default credentials are frequently exploited by attackers and automated botnets scanning the internet for vulnerable devices.
Reference
Cybersecurity and Infrastructure Security Agency. Securing Internet Connected Devices.
https://www.cisa.gov/resources-tools/resources/securing-internet-connected-devices
Once attackers locate a device using known default credentials, they can authenticate to the device remotely and gain administrative control.
In the case of networked printers, attackers may gain access to the following capabilities.
-
Stored documents within printer memory
-
Print queues containing sensitive files
-
Network configuration information
-
Firmware level access
-
Network pivot points into the local environment
These capabilities can expose sensitive healthcare information.
Why Printers Are a High Value Target
Printers are frequently overlooked in cybersecurity programs. Yet they are effectively full network computers with storage, operating systems, and network access.
Healthcare environments rely heavily on printing workflows. Medical records, prescriptions, lab results, referral documents, and billing records are routinely printed.
According to the National Institute of Standards and Technology, multifunction printers should be treated as networked information systems and secured accordingly. These devices often store copies of printed or scanned documents within internal storage systems.
Reference
National Institute of Standards and Technology. Guidelines for Managing the Security of Mobile Devices in the Enterprise.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-124r2.pdf
If an attacker compromises a printer used in telehealth operations, they may gain access to stored documents or intercept documents moving through the print pipeline.
In a clinical setting, those documents can include protected health information.
IoT Botnets and Healthcare Devices
The scenario also describes compromise through an IoT botnet.
IoT botnets are networks of compromised devices controlled by attackers. These botnets scan the internet looking for vulnerable systems such as routers, cameras, and printers.
The Mirai botnet demonstrated how quickly IoT devices can be weaponized. Mirai infected hundreds of thousands of internet connected devices using default credentials and used them to launch large scale distributed denial of service attacks.
Reference
US Department of Justice. Mirai Botnet Authors Plead Guilty.
https://www.justice.gov/usao-nj/pr/three-men-plead-guilty-creating-and-operating-mirai-botnet
Although Mirai targeted DDoS operations, similar botnets are frequently used for other malicious activities including data exfiltration and network reconnaissance.
Healthcare environments are particularly attractive targets because of the value of medical records.
According to IBM Security research, healthcare breaches have consistently ranked among the most expensive across all industries.
Reference
IBM Security. Cost of a Data Breach Report.
https://www.ibm.com/reports/data-breach
How Patient Data Can Be Exfiltrated During Telehealth Sessions
Once attackers gain control of a network device, they can observe network traffic moving through the environment.
In remote telemedicine environments, this traffic may include:
-
Telehealth video sessions
-
Medical records transmitted between systems
-
Secure messaging between clinicians
-
Document transfers and print jobs
If network segmentation and encryption controls are not implemented correctly, attackers can capture or redirect sensitive information.
Even when encrypted communications are used, compromised devices can still serve as footholds for deeper network access.
Attackers often use compromised IoT devices to perform reconnaissance. They map the network, identify additional targets, and attempt lateral movement.
Why Incidents Often Go Undetected for Months
One of the most troubling aspects of the incident described is the detection gap. The compromise remained undetected for six months.
This type of delay is common when unmanaged devices are involved.
Traditional security monitoring tools focus on endpoints such as laptops, servers, and corporate infrastructure. IoT devices are often invisible to these systems.
Without asset visibility, organizations cannot monitor devices for compromise or suspicious behavior.
The National Institute of Standards and Technology highlights asset visibility as a foundational requirement for cybersecurity programs. Organizations must maintain accurate inventories of connected systems to detect unauthorized or compromised devices.
Reference
National Institute of Standards and Technology. Guide for Cybersecurity Event Recovery.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-184.pdf
If a device is not known to security teams, it cannot be monitored.
The Root Cause. Unmanaged IoT in Trusted Environments
The root cause of many modern security incidents is not sophisticated malware or advanced nation state attackers.
It is visibility failure.
Remote healthcare environments introduce hundreds or thousands of unmanaged devices into clinical ecosystems. Each of these devices becomes part of the extended attack surface.
Without proper discovery and monitoring, security teams operate with blind spots.
Security frameworks increasingly emphasize asset visibility and continuous monitoring as foundational controls. Cybersecurity Asset Attack Surface Management platforms focus specifically on discovering and monitoring all assets across distributed environments.
These technologies help organizations identify unmanaged systems, detect vulnerabilities, and reduce security blind spots.Â
By creating a complete inventory of assets across remote and hybrid networks, security teams can detect unknown devices before attackers exploit them.Â
Practical Security Measures for Telehealth Environments
Healthcare organizations must treat remote clinical environments as extensions of the enterprise network.
The following controls are widely recommended by cybersecurity frameworks and federal guidance.
Change Default Credentials Immediately
Every connected device should have unique authentication credentials. Default manufacturer passwords must be changed during deployment.
Maintain Complete Asset Visibility
Organizations must maintain an accurate inventory of every device connected to healthcare networks. This includes printers, routers, webcams, and IoT devices.
Implement Network Segmentation
Medical devices, IoT systems, and administrative systems should operate on separate network segments. Segmentation limits lateral movement if a device becomes compromised.
Monitor Remote Networks
Remote clinical environments should be continuously monitored for suspicious behavior, unauthorized devices, and security vulnerabilities.
Apply Zero Trust Principles
Zero trust architectures require continuous verification of users, devices, and network conditions before granting access to resources. This reduces the risk associated with compromised endpoints or unmanaged devices.Â
The Reality of Modern Healthcare Cybersecurity
Telemedicine will continue expanding as healthcare systems evolve. Remote care offers significant benefits for patients and providers.
However, the infrastructure supporting telehealth is fundamentally different from traditional hospital networks. It is distributed, dynamic, and difficult to control.
Security strategies must adapt accordingly.
Unmanaged devices are no longer minor operational issues. They represent a major security exposure that attackers increasingly exploit.
Healthcare organizations that fail to gain visibility into remote networks will continue to experience incidents like the one described in this scenario.
The lesson is clear.
You cannot secure what you cannot see.
Asset discovery, continuous monitoring, and strong device security practices must become standard operating procedures for telemedicine environments. Only then can healthcare providers protect patient data while delivering the remote care that modern medicine now requires.