Article
Medusa remains active against health care
On Aug. 19, the FBI, CISA and HHS released an updated joint advisory on Medusa, a ransomware-as-a-service operation first identified in 2021. The group has hit more than 500 victims, and FBI investigations found activity as recently as April. Health care is a frequent target. Medusa uses double extortion: it encrypts data and threatens to publish what it stole if the ransom goes unpaid.
The update adds detail on how Medusa works with affiliates, what it pays brokers who sell initial access to victim networks, and a longer list of exploited vulnerabilities. The AHA noted that the group claimed an attack this year on a regional Level 1 trauma center that disrupted care delivery.
Controllers that run the physical plant
A day earlier, the NSA and partner agencies warned of active attacks on Siemens S7 series programmable logic controllers. These small industrial computers run equipment such as climate control and door access in hospitals. Attackers use internet scanning services to find controllers with outdated software or weak protection, then disguise malicious scripts as routine monitoring tools.
The AHA’s cyber team said the warning applies to other controller brands too, and advised disconnecting vulnerable units from the internet or moving them to isolated networks. For a hospital, losing air handling in an operating suite, pressure control in isolation rooms or badge access in a behavioral health unit is a patient safety event, not only an IT problem.
Questions for the next leadership meeting
- Who owns the building systems? Facilities teams and vendors often manage controllers outside the security program. Confirm that they are in the asset inventory and covered by patching and monitoring.
- Are any controllers reachable from the internet? Ask for an external exposure scan and a plan to isolate anything found.
- How do vendors connect? Remote access for maintenance contractors is a common entry point. Require multifactor authentication and logged, time-limited sessions.
- Can we run without the network? Test downtime procedures for both clinical systems and environmental controls, and include facilities staff in tabletop exercises.
- Have we reviewed the Medusa indicators? Have the security team check the advisory’s vulnerability list against your environment and report back with dates for closing gaps.
Archive entry for Aug 23, 2026, added Nov. 11, 2026.