Responding to a SIM-Swap Attack on an ICU Bedside Monitor Network

A SIM swap can redirect a cellular number or service to a SIM controlled by an attacker. In an ICU, that may disrupt a monitor’s cellular connection or expose related carrier and account access; it does not, by itself, prove that a monitor reading has been altered. Treat the event as both a patient-safety concern and a cybersecurity incident: verify care at the bedside, preserve evidence, and coordinate clinical and technical decisions.

How do you verify patient safety and monitor readings during an incident?

Start with the patient, not the network dashboard. A qualified clinician should assess the patient’s condition and compare displayed values with clinical signs and an independent, clinically appropriate measurement when indicated. If a reading does not fit the patient’s condition, treat it as unverified; follow unit escalation procedures and do not rely on that value alone for a treatment decision.

Check whether the monitor is alarming as expected, whether the waveform and trend make clinical sense, and whether the same value appears at the bedside and central station. A normal-looking display is not proof that its data path is trustworthy. Use an approved alternative monitoring method or device if needed, and maintain observation appropriate to the patient’s acuity.

The FDA advises health care providers to look for unusual monitor function, including inconsistencies between displayed vital signs and the patient’s physical state. Its specific recommendations about local-only monitoring apply to the Contec CMS8000 and Epsimed MN-120 monitors identified in its safety communication; do not assume those directions apply to every monitor. See the FDA patient-monitor cybersecurity safety communication.

When should you isolate bedside monitors from network or cellular connections?

Isolate a monitor or its communications path when evidence suggests the connection is enabling unauthorized access, suspicious configuration changes, unexpected traffic, or unreliable readings. But do not disconnect a device reflexively: removing a link can also interrupt central-station visibility, remote alarms, or other clinically important functions. Before making a change, identify what monitoring will be lost and arrange a safe alternative.

When feasible, have IT or network staff block the suspect cellular or network path at a controlled point—such as the carrier account, gateway, firewall, or network segment—rather than pulling power or disabling the monitor without clinical oversight. Confirm with the bedside team that local alarms and observation remain adequate, and document the action and time. If immediate danger requires urgent containment, prioritize patient safety while coordinating the fastest safe isolation.

For the specific Contec and Epsimed models in its notice, the FDA recommends local monitoring only when remote monitoring is not required, with Ethernet disconnected and Wi-Fi or cellular capability disabled; if the device relies on remote monitoring or wireless cannot be disabled, the FDA advises stopping use and arranging an alternative. Follow the device-specific notice and hospital procedure rather than applying this direction to all monitors.

How can you contain SIM-swap and account access risks?

Contact the cellular carrier’s fraud or security channel using a trusted number or account portal—not a number supplied in a suspicious message. Ask the carrier to investigate the unauthorized SIM change or number transfer, restore authorized service, block further SIM changes and port-outs where available, secure the account with a unique PIN or passphrase, and provide an incident reference and relevant records. Ask which account-protection options the carrier supports; names and availability vary.

Review accounts that use the affected number for password recovery or text-message authentication, including carrier, device-management, remote-monitoring, email, and administrator accounts. From a clean, trusted device, revoke suspicious sessions and tokens, reset affected credentials, and remove the compromised number as a recovery method where possible. Prefer phishing-resistant multi-factor authentication—such as a FIDO security key or passkey—over SMS for privileged access when supported. CISA recommends prioritizing phishing-resistant MFA for administrator and privileged accounts in its phishing guidance.

The FCC’s order requires wireless providers to use secure authentication for SIM changes and port-outs, notify customers of such requests, and maintain processes to report and remediate fraud. Ask the carrier to apply its available protections and preserve documentation; these measures do not replace the hospital’s own account and device safeguards. See the FCC order on SIM-swap and port-out fraud.

Which clinical and technical teams should coordinate the response?

Use the hospital’s incident-command and cybersecurity procedures. The bedside nurse and responsible clinician should lead patient assessment and continuity of monitoring; biomedical engineering or health care technology management should identify monitor dependencies and safe device actions; IT and cybersecurity should investigate carrier, identity, network, and system access; and clinical engineering should coordinate with the monitor manufacturer or service provider.

Include the unit charge nurse or clinical leader, network and identity administrators, privacy or compliance staff, risk management, and hospital leadership as appropriate. Contact the cellular carrier and relevant technology vendors through established channels. Assign a response lead, keep a shared timeline, and make clinical and technical decisions together so that containment does not silently remove essential alarms or surveillance.

The medical-device cybersecurity incident response playbook identifies clinicians, health care technology management, IT, emergency response, risk management, and facilities personnel among the stakeholders who may need to coordinate.

What logs and device details should you preserve?

Preserve relevant evidence as soon as practical, without delaying urgent patient-safety measures. Record the incident timeline, including observed symptoms, reported SIM or service changes, alarm behavior, isolation steps, and who authorized each action. Note the device manufacturer, model, serial number, asset tag, software and firmware versions, physical location, network identifiers, and cellular-modem and SIM identifiers if available.

Request and preserve monitor, central-station, gateway, firewall, wireless, identity-provider, remote-management, and carrier account records for the relevant period. Include authentication successes and failures, password or recovery changes, SIM provisioning or replacement events, number-port requests, configuration changes, alarms, and connection or disconnection events. Preserve relevant waveforms and trends under hospital privacy and records procedures.

Keep original exports where possible, record who collected them and when, and restrict access to authorized investigators because logs and monitor data may contain protected health information. HHS explains that audit controls and regular review of system activity help regulated entities detect incidents, and that incident response should include collecting and preserving relevant data. See the HHS OCR cybersecurity newsletter on audit logs and incident response.

How can you detect manipulated readings and unusual device activity?

Compare displayed readings with the patient’s clinical presentation, a suitable independent measurement, and—where available—another trusted monitoring source. Check for abrupt unexplained changes, implausible trends, missing or frozen waveforms, repeated resets, alarm changes, unexpected timestamps, or differences between the bedside display and central station. These signs warrant investigation, but none alone establishes that readings were deliberately manipulated.

Technical staff should compare device and network records against the incident timeline and expected behavior for that monitor model. Look for unfamiliar logins, new sessions, changed settings, unexpected outbound connections, unusual cellular provisioning events, or device reboots. Ask the manufacturer to interpret model-specific logs and assess whether observed behavior is consistent with a known issue. Maintain direct clinical verification while the device’s integrity remains uncertain.

FDA guidance emphasizes that cybersecurity issues in networked medical devices can create health risks and require ongoing risk management. Its postmarket medical-device cybersecurity guidance discusses managing vulnerabilities throughout a device’s lifecycle.

How should monitoring be restored and network exposure reduced?

Do not reconnect a monitor solely because cellular service or a carrier account has been restored. First confirm that the carrier account and relevant credentials are secured, suspicious sessions are revoked, and the suspected access path has been addressed. Have biomedical engineering, IT or cybersecurity, the responsible clinical team, and the manufacturer determine what checks and remediation are appropriate for the device.

Restore connectivity in a controlled, documented sequence. Verify device identity and configuration, local alarms, bedside readings, central-station display, and any remote-monitoring functions that the care plan requires. Keep an appropriate alternative monitoring plan in place until the clinical team confirms that required surveillance is functioning and the technical team accepts the connection for service.

Reduce future exposure with bedside monitor network segmentation, restrictive firewall rules, and access limited to required services. Review cellular modem SIM provisioning and carrier number port-out protection; avoid relying on SMS as the sole recovery or authentication method for privileged accounts. Update the asset inventory and response plan, and review the incident for any notification or reporting duties that may apply. HHS describes containment, mitigation, recovery, and post-incident review as elements of security incident response; see its incident response guidance.

In short, protect the patient first, isolate only with a clinically safe continuity plan, secure carrier and related accounts, preserve evidence, and validate both clinical monitoring and cybersecurity before restoring network access.

FAQs.

What should clinicians do if monitor readings do not match a patient’s condition?

Assess the patient directly, treat the readings as unverified, and follow the unit’s clinical escalation procedure. Use an independent, clinically appropriate measurement or an approved alternative monitor, and maintain observation suited to the patient’s acuity. Notify the responsible clinician and biomedical engineering or the incident response team.

When is it clinically safe to disconnect a bedside monitor from the network?

It is safe only when the responsible clinical team has considered what functions disconnection will interrupt and arranged an adequate alternative for any lost central or remote monitoring. Coordinate the change with IT or cybersecurity and biomedical engineering, and follow device-specific manufacturer and hospital procedures. Do not disconnect power or communications in a way that leaves the patient without required monitoring.

How can a carrier prevent further SIM swaps or number transfers?

Contact the carrier’s fraud or security team and ask it to investigate, restore authorized service, block further unauthorized changes, secure the account with a unique PIN or passphrase, and enable available SIM-change or port-out protections. Ask for an incident reference and documentation. Available controls differ by carrier, so confirm which protections are active on the affected account.

Which logs should be preserved after a suspected monitor network compromise?

Preserve relevant monitor and central-station logs, network and firewall records, identity and remote-access activity, carrier SIM or port-out records, alarm and configuration history, and applicable waveforms and trends. Record device identifiers, software versions, timestamps and time zones, and every containment action. Maintain the original evidence and limit access under hospital privacy and evidence-handling procedures.