19.01.2026

Cyberattacks on medical facilities and networked devices are rapidly increasing. For medical technology companies, this means that security must be considered from the outset. The EU Cyber Resilience Act also makes IT security a regulatory requirement.

In short: Why invest in cybersecurity?

Cyberattacks on the healthcare sector are increasing dramatically.
The EU Cyber Resilience Act makes IT security mandatory for all digital medical devices.
Networked and outdated systems increase the attack surface.

Cyberattacks increasingly targeting medical technology

Hacked monitoring devices, manipulated infusion pumps, or blocked hospital servers—these scenarios have long been a reality. According to the German medical reporting from Ärzteblatt, attacks on the healthcare sector in Germany rose by 74 percent between 2022 and 2023. The German Federal Office for Information Security (German: BSI) also reported an alarmingly high level of 3,693 security-related events and 205 confirmed incidents in 2024. A lack of security measures not only jeopardizes data, but also patient safety – and undermines confidence in modern medical technology.

Regulatory pressure: The EU Cyber Resilience Act

The EU Cyber Resilience Act (CRA) obliges manufacturers to ensure cybersecurity throughout the entire product lifecycle. Security must not only be confimed at time of implementation but must be integrated early on in the development process. Our COMPAMED experts also confirm this:

Smiling woman with brown hair wearing glasses in front of plants and a wall with the inscription “Seleon”; Copyright: seleon GmbH

Dr. Nadine Stech; Copyright: seleon GmbH

"The Cybersecurity Resilience Act underscores the need for effective cybersecurity management in the EU for all products with digital components. Close cooperation between manufacturers and development service providers is essential here in order to effectively implement regulatory and safety requirements."

The CRA supplements existing frameworks such as the MDR or the IEC 81001-5-1 standard and requires transparent proof of security measures.

Growing vulnerabilities due to networking

A monitor is in the front. A human graphic can be seen on it. People in hospital clothing can be seen in the background.

Patient data requires special protection against unauthorized access.

Modern medical technology is highly networked—with hospital networks, mobile apps, and cloud services. This brings advantages but also increases the risk of attacks. The mix of old devices without security updates and new networked systems is particularly risky. The fragility of critical infrastructures became apparent in 2024: Availability problems in insured person master data management temporarily paralyzed e-prescription services – without any orchestrated attack. (Source: BSI)

Shutdowns of entire hospital wards, data encryption by ransomware, and manipulation of device settings are incidents that have already been documented worldwide.

Why manufacturers need to act NOW

Regulatory obligation: The CRA requires security by design and documented protective measures.
Technical pressure: Connected devices create new areas of vulnerability and require continuous monitoring.
Reputational risk: Cyber incidents can permanently damage trust in a product.
Patient safety: Malfunctions caused by attacks can have a direct impact on therapies.
Economic damage: Downtime, recalls, or liability issues can incur immense costs.

Cybersecurity is no longer a downstream development step, but a prerequisite for modern medical technology. Upfront investment in security processes minimizes risks and strengthens the trust of clinics, authorities, and users.

Cybersecurity by Design