The maker of breathing circuits and humidifiers used in hospital respiratory care disclosed on October 22 that an intruder reached two employee email accounts and corporate files, adding the medical device supply chain to this year’s breach list.
Fisher & Paykel Healthcare, a New Zealand company whose products sell in more than 120 countries, said it detected unauthorised and unlawful access, activated response protocols, notified authorities, and is contacting people whose personally identifiable information appeared in the files.
The company said its manufacturing, products, and supply chain were untouched and that it found no evidence the incident reached the system holding patient data. It also reported no sign of ransomware or malware and said it does not expect a material financial hit.
That framing deserves scrutiny rather than dismissal. Respiratory devices sit in ICUs and neonatal units, so any doubt about supply continuity draws attention from hospital procurement teams. More practically, employee mailboxes are where device makers hold contracts, clinical training material, complaints, and sometimes patient-identifiable case data.
HME News and Reuters both reported the disclosure, which followed the company’s own regulatory statement.
For hospital supply chain and security leaders, the disclosure is a vendor-risk data point: ask device makers on your roster whether they segregate clinical data from corporate email, whether mailbox access logs are retained long enough to scope an incident, and how they would notify providers if a cyber event threatened availability of ventilators or humidification circuits. Procurement teams should also confirm these questions are in contract language, not just on a questionnaire.
