Healthcare just had its worst year on record for breached patient data. According to the HIPAA Journal, 2024 saw nearly a 10 percent jump in exposed healthcare records compared with 2023.

That spike did not come from some unstoppable new zero day. It came from the same old mistakes that have been haunting IT teams since the dial up era: missing multi factor authentication, unpatched Windows devices, and third party vendors nobody really vetted.

At the same time, regulators are tightening the screws and quantum computing is quietly stalking todays encryption. That mix leaves a lot of healthcare leaders and medical device teams stuck: do you fight the fires in front of you, or plan for the so called Q day future when current crypto breaks?

The honest answer: you have to do both. But not the way the hype cycle tells you.

The uncomfortable truth: big brands are failing at basic cyber hygiene

Let us start with two headline making incidents pulled straight from the recent reporting in Medical Device Network on cybersecurity in healthcare.

In 2024, UnitedHealth Group subsidiary Change Healthcare was breached because a portal in its environment was exposed without multi factor authentication. This is a company that touches the data of roughly 190 million Americans, and yet a single missing control on a single portal was all an attacker needed. You can read the testimony straight from UnitedHealths CEO in the U.S. Senate Finance Committee record.

In the UK, the National Health Service was hit hard when its third party pathology provider Synnovis suffered a major cyberattack. It was a brutal example of how your security is only as strong as the vendors plugged into your network and workflows.

These are giant organizations with deep pockets, regulators breathing down their necks, and full time security teams. Yet they are still getting taken out by phishing emails, weak authentication, and poorly managed third party access.

If you run a regional hospital, a small clinic, or you build connected medical devices, that should not scare you. It should simplify the problem. Because if the biggest players are tripping over the basics, then getting the basics right is exactly where you can create an advantage.

The attack surface exploded while nobody was looking

Healthcare is now one of the most data heavy industries on the planet, second only to finance in the volume of highly sensitive data it holds. At the same time, medical technology has gone all in on connectivity.

Deloitte research suggests that by 2025 roughly 68 percent of medical devices will be connected: smart pumps, remote monitors, wearables, and cloud linked imaging equipment that feed data into apps and analytics platforms. That connectivity is amazing for patient outcomes and operational efficiency. It is also an attackers playground.

Every Bluetooth module, every Wi Fi chip, every cloud integration is another possible path into your network and your patient data. That is why voices like Mohammad Waqas, chief technology officer for healthcare at Armis, argue that medical device security has to move away from piecemeal bandaids and toward a holistic view of the attack surface: the devices, the networks they sit on, and the third parties they talk to.

The encouraging shift Waqas is seeing is that organizations are starting to “shift left” on security. Instead of plugging in a new device and hoping for the best, more providers want to understand its security posture before they put it on the network, sometimes even before they buy it.

Regulation is finally forcing security into the design phase

This mindset shift is not happening in a vacuum. It is being pushed by a wave of new regulations that finally treat cybersecurity as a design requirement, not an afterthought.

In Europe, the Medical Device Regulation and the Artificial Intelligence Act are nudging manufacturers to show how they will harden devices, support security controls, and deliver patches when vulnerabilities are discovered. It is no longer enough to prove that a device works; you have to prove that you can keep it safe over its lifetime.

On top of that, the Data Act (effective September 2025) will require that users can access the data uploaded to and generated by connected devices, and that manufacturers obtain clear consent to reuse that data, for example to improve products or to train AI models. As Christopher Jeffery of Taylor Wessing notes, this Act is still flying under the radar compared to AI regulation, but it will matter a lot to anyone building or buying connected medtech.

Then there is NIS2, which already applies across the EU (with some patchy national implementation). It sets general cybersecurity requirements for “essential and important” sectors, including medical devices and in vitro diagnostics, covering everything from supply chain risk to incident reporting.

If that sounds like regulatory overload, here is the mental reset: instead of treating each law as another box to tick, you can use them as a checklist for building a cleaner, simpler environment that is easier and cheaper to secure.

Cloud workflows done right: design security into the workflow, not bolted on

The article from Medical Device Network highlights a compelling example in the cell and gene therapy space: Autolomous, the company behind the cloud based Autolomate platform.

Instead of pushing out a cloud system and promising to “add security” later, Autolomous built around security from day one:

• Single sign on by default, so each client manages its own access and identities.
• Single tenant environments, meaning each customers data is logically isolated from everyone else.
• Fine grained permissions for who can see and do what, tuned to how the therapy workflows actually operate.
• Distributed ledger technology to keep an immutable, auditable record of every access and permission change.
• Regular disaster recovery exercises and customer configurable backup frequencies.

That is not just a security story. It is an operational story. When your platform is both auditable and tightly permissioned, it is easier to diagnose problems, prove compliance, and sleep at night.

The takeaway for smaller teams and clinics is not that you need your own blockchain. It is that you should insist on vendors who can clearly answer three basic questions:

• How do you authenticate and authorize every user?
• How do you segregate my data from everyone elses?
• How do you prove, in detail, who did what and when if something goes wrong?

Q day is coming: why post quantum crypto matters to healthcare

While healthcare still struggles with phishing and missing patches, another threat is slowly moving out of the labs and into the real world: quantum computing.

Modern quantum processors, like IBMs Quantum Heron announced in late 2024, are already showing huge performance jumps over previous designs. That does not mean they can crack todays encryption tomorrow morning, but serious cryptographers largely agree on one thing: if you store valuable data long enough, someone will eventually throw a quantum computer at it.

The concern is that quantum machines will be able to break widely used algorithms like RSA and elliptic curve cryptography. Researchers have been mapping out this impact for years, and the U.S. National Institute of Standards and Technology (NIST) has now published its first set of post quantum cryptography (PQC) standards to defend against that future.

As Ben Packman of PQShield notes, the organizations thinking hardest about PQC today tend to be those selling into the U.S. government. But the standards are public, and there is no reason healthcare should wait for a memo from a regulator before getting ready.

For medical device makers, there is an extra twist: many embedded, connected devices are deployed for five, ten, or more years. That means products you are designing now could still be in the field well past 2030, when todays crypto may no longer be enough.

That is why Packman argues that now is the time for medical device manufacturers to sketch their PQC roadmap, especially for devices that handle or protect long lived patient data.

A practical playbook: back to basics, forward to quantum

All of this can sound overwhelming: exploding attack surfaces, new regulations, post quantum algorithms, and headlines about giant providers getting taken down. So let us strip it down into a concrete two track playbook you can actually act on.

Track 1: Lock down the boring basics in the next 12 months

This is where most healthcare organizations and medtech teams can get the fastest risk reduction for the lowest effort. If any of these are not true for your environment today, this is your to do list.

• Multi factor everywhere it matters. Any portal, remote access tool, cloud dashboard, or email system that touches patient data needs strong MFA. That is how you avoid being the next Change Healthcare headline.
• Inventory and segment your devices. You cannot defend what you cannot see. Build an inventory of connected medical devices, workstations, servers, and cloud services. Then make sure high risk devices live on segmented networks, not wide open flat LANs.
• Have a real patching strategy. With Windows 10 support ending in October 2025, many organizations will be stuck on outdated hardware they never budgeted to replace. As Jon Abbott of ThreatAware and James Rawlinson of Rotherham NHS both highlight, that is a recipe for future breach reports. Decide now whether you will upgrade, isolate, or retire those systems.
• Clean up vendor access. List every third party that has network, VPN, or portal access, and tighten it. Use least privilege, enforce MFA on their accounts, and require them to meet your minimum security standards.
• Drill your backup and recovery. Like Autolomous, you should be able to show that you can restore your systems and data to a known point. Backups are only real when you have tested recovery.
• Train for phishing with reality, not fear. Phishing has been around since the 1990s, yet it still works because we train people with generic slides and no connection to their daily work. Use short, contextual drills that mirror the tools and workflows your staff already use.

Track 2: Quietly bake quantum readiness into your upgrades

You do not have to rip and replace all your crypto tomorrow. But you do need a plan that lines up with how your hardware and software naturally refresh over time.

• Map where crypto actually lives. Identify which systems and devices rely on RSA or elliptic curve crypto for authentication, key exchange, or long term data storage. Pay special attention to embedded devices and long lived archives of patient data.
• Make PQC a requirement for new designs. For any new product or platform that will ship after 2027 and live into the 2030s, require support for NIST approved PQC algorithms in your design specs.
• Plan for bigger keys and new resource requirements. Many PQC schemes use larger keys and have different performance profiles, which can impact low power devices. That is a hardware design decision, not a last minute software patch.
• Use PQC migration as a chance to clean house. As Packman points out, healthcare is full of fractured, legacy IT. When you touch a system for PQC, also patch the obvious vulnerabilities, remove dead integrations, and simplify where you can.

Why do we keep repeating the same cybersecurity mistakes?

The frustrating part of the current threat landscape is how often the same issues repeat. Missing MFA. Old Windows boxes nobody owns. Vendors with flat access. Phishing emails that look like they were written in 1998.

Part of the problem is that healthcare is mission critical and under constant budget pressure. When you are choosing between another nurse on the floor and a new firewall, the firewall often loses. Another part is that technology has been sold as magic, not as infrastructure that demands maintenance.

But there is also a cultural problem: we too often treat cybersecurity as a compliance checkbox instead of a shared responsibility.

Waqas from Armis calls for a “back to basics” approach: do not chase every buzzword until you have the fundamentals locked in. That does not sound glamorous, but it is exactly what reduces the blast radius when something inevitably goes wrong.

The advantage for teams willing to do the unglamorous work

If there is a silver lining in the recent wave of healthcare breaches, it is this: the bar is not as high as you think. When multi billion dollar giants are still losing patient data to phishing and missing MFA, a clinic, lab, or device startup that does the boring work well can be more resilient than the incumbents.

That is where teams like TNT Nerds like to sit: right in the gap between regulatory theory and what is actually running in your server closet, on your nurses workstations, and inside your devices in the field.

You do not need a hundred page strategy deck. You need a small, prioritized list of actions and a partner who will help you keep them done when everyone else has moved on to the next crisis.