Christiaan Beek, VP of Cyber Intelligence at Rapid7, explores how legacy medical technologies and expanding digital infrastructure are exposing NHS systems to growing cyber-risks, and why securing internet-facing assets has become critical to protecting patient data and clinical operations.
Securing digital connections such as medical devices and remote-access imaging portals is a challenge faced by healthcare organisations worldwide and the NHS is similarly navigating this evolving area as digital technologies become more embedded in clinical care.
An example of this that always sticks in my memory is when my wife went for an ultrasound. My attention was caught not by the image on the screen but by a line of text beneath it: ‘writing image to disk – transfer DICOM.’
Digital Imaging and Communications in Medicine (DICOM), is the international protocol used to format, store and transmit medical imaging data across CT scanners, MRI machines and picture archiving and communication systems (PACS).
For many people, quite understandably, that detail would pass unnoticed, but as a threat researcher, I couldn’t help but take a deep dive into DICOM and uncover a world of security problems.
However, DICOM risks represent a broader and more systemic challenge of a rapidly expanding attack surface across NHS environments.
A boundary that no longer exists
Historically, healthcare networks operated within clearly defined perimeters. Systems were deployed on internal networks and security strategies were built around keeping external threats out. That model has changed.
Today’s healthcare environments are distributed across hybrid infrastructures that include cloud platforms, third-party services, remote access solutions and on-premises systems. Clinicians require access from multiple locations, patients interact through digital platforms and devices continuously transmit data across networks.
At the same time, legacy protocols remain operational because imaging equipment carries service lifecycles measured in decades and vendor-default configurations are often inherited rather than reviewed at deployment.
In this context, the distinction between internal and external systems has become increasingly blurred. Assets that were never designed to be publicly accessible can, through misconfiguration or evolving operational needs, become reachable from the internet.
What I found when looking into DICOM
DICOM provides a useful lens through which to understand this problem. It was designed for use within controlled clinical networks, not the public internet. Patient identifiers, study details, acquisition parameters and clinician notes are all embedded within each image file.
The assumption built into the protocol’s architecture was that the surrounding network would provide the necessary access controls. In too many healthcare environments, that assumption is being made without verification.
As a result, when investigating, we found multiple instances of DICOM services responding to requests over the public internet. These systems, in many cases, were not protected by modern authentication or encryption mechanisms.
We identified more than 30 UK healthcare systems responding to DICOM requests, along with over 15 PACS devices accessible via standard web ports, some even exposing admin login pages publicly.
Earlier global findings revealed similar patterns, with exposed DICOM endpoints allowing access to sensitive imaging data. These discoveries highlight how easily legacy technologies can become vulnerable when deployed in modern, interconnected environments.
Importantly, DICOM is not unique. Many medical technologies share similar assumptions about network trust and security. When these systems are exposed to the internet, they carry risks that extend well beyond their original design parameters.
How internet-facing assets exposure creates risk
One of the most immediate concerns is the exposure of patient data. Systems using DICOM routinely store structured information such as patient names, dates of birth and clinical details.
Unlike financial data, this information cannot simply be reset or reissued, making it particularly valuable and long-lasting if compromised. For example, when testing DICOM servers, we were able to retrieve sensitive data from a significant proportion of exposed services, underscoring how real and accessible this risk can be.
Beyond confidentiality, there is a more complex and potentially more serious issue of the integrity of clinical data. Healthcare systems depend on the assumption that diagnostic information is accurate and trustworthy.
However, research has shown that medical images and associated data can be altered without triggering alerts. In practical terms, this raises the possibility that clinical decisions could be influenced by tampered data, putting patient safety at risk.
Finally, exposed medical assets create pathways for broader network compromise. Imaging systems, remote access services and other externally reachable technologies are often connected to core clinical infrastructure.
If one system is accessible from the internet, it can provide a foothold for attackers to move deeper into the environment. In healthcare networks, this can quickly escalate into operational disruption.
Taken together, internet exposure is a direct line to data compromise, clinical risk and system-wide disruption.
How the NHS secures internet-facing assets
The issue is not a lack of cybersecurity awareness within the NHS. It has invested considerably in cybersecurity tools and policy, but the challenge is that it doesn’t automatically translate into visibility.
The starting point for the NHS is to first question whether a system explicitly needs to be accessible from outside trusted clinical or enterprise networks. In the case of imaging systems using the DICOM protocol, this should not be the case.
Where external access is required, it should never be direct. Instead, access must be mediated through controlled entry points such as VPNs, zero trust network access or secure application gateways. These mechanisms ensure that authentication, device posture and user identity are verified before any connection is established with sensitive clinical systems.
Strong identity controls are essential, including multi-factor authentication for all external access paths and strict management of privileged accounts. These controls reduce the risk of credential misuse, which is a common factor in healthcare breaches.
Network segmentation is equally important. Internet-facing services should be isolated from core clinical systems such as electronic health records and imaging archives. Without segmentation, a single exposed service can become a pathway into broader hospital infrastructure, significantly increasing the impact of compromise.
Finally, organisations need continuous visibility of their external attack surface. As our DICOM research shows, exposures are often not static misconfigurations, but evolving gaps created by system growth and change. Continuous discovery and monitoring are therefore critical to ensuring that new internet-facing assets are identified and secured before they can be exploited.
As the cyber landscape continues to evolve, so too must the defences that guard against potential threats. Healthcare organisations should make it part of their business strategy to regularly scan their exposure to the internet and institute robust protections against potential risks.
