Snap, Crackle, Popped - How to manage a massive cyber attack

This BioHacking Village panel brings together a former CISO of a medical device maker, the CISO of a Boston hospital, and a division director from the FDA's medical device cybersecurity group. They open with the first 45 minutes after an attack is discovered, describing how the shock of the event gives way to playbooks while teams try to judge whether they face a worst case or something manageable.

The middle of the discussion covers containment and coordination. The hospital perspective is that isolating connections is increasingly the first move, with decisions made quickly and documented so systems can be reconnected later. The regulator's focus is patient access: whether a manufacturer can keep supplying devices, whether cloud-connected products can stay online, and whether a shortage is forming. The panel also points to breakdowns between IT, emergency management and clinical teams, and to competing priorities such as clinical uptime, forensic preservation and reporting duties.

Looking toward the 72-hour mark, the speakers stress staff fatigue, rotating shifts and basic needs like rest and food as sources of error. They close on the legal balance of public communication, arguing that explaining what others can do to protect themselves matters more than assigning blame. Practitioners should take away the need to settle decision-making authority before an incident, document choices as they happen, and rehearse downtime processes.