Robotic surgery firm Intuitive reports data breach after targeted phishing attack

Intuitive suffered a phishing attack leading to a data breach exposing customer, employee, and corporate information.

Intuitive is an American company that designs, manufactures, and sells robotic systems for minimally invasive surgery. Its most well-known products include the da Vinci Surgical System for general surgery and the Ion endoluminal system for precise procedures inside the lungs. These robotic platforms help surgeons perform complex procedures with smaller incisions, greater precision, and faster recovery times for patients.

The company disclosed a data breach caused by a targeted phishing attack. Threat actors used a compromised employee account to access internal systems, exposing customer contact details, employee data, and corporate information. The company quickly responded by securing affected applications and activating incident response measures.

“Intuitive has determined that information from certain internal IT business applications was accessed by an unauthorized third party as the result of a targeted cybersecurity phishing incident.” reads the notice published by the company.

“Upon discovery, we quickly activated our incident response protocols and secured all affected applications. We are providing this web update to be transparent about this issue beyond any required notifications.”

The company did not disclose the attack timeline or the number of impacted individuals.

Intuitive pointed out that its da Vinci, Ion, and digital platforms were unaffected by the cyberattack. Its network is segmented, keeping internal IT systems, manufacturing, and surgical platforms separate. The company states that hospital networks remain independent and secure. Operations and customer support continue as usual, as robotic systems have their own security and operate independently of the breached business network.

At the time of this writing, the cyberattack is fully contained, and according to the company, it shouldn’t materially affect its business or finances. The firms already notified regulators.

Robotic surgery leads in minimally invasive procedures, sometimes surpassing traditional methods. Rising cyberattacks underscore the need for stronger security, which could strain already tight healthcare budgets.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, phishing)