In September 2015, the FBI issued an alert that Web-connected medical devices, such as wireless heart monitors and insulin dispensers, pose a cybersecurity risk, and warned organizations that they need to protect these devices from cyber threats. Two months later, the Department of Health and Human Services' Office of the Inspector General announced it would investigate whether the networked medical devices at the country's hospitals had sufficient security in place to safeguardelectronic protected health information (ePHI) and ensure patient safety. For in health care, cyber threats come not just in the form of hacked patient information, but in forms that the retail and financial sectors never have to consider: massive injuries and deaths and the complete disruption of a vital infrastructure. The "bad guys" are no longer twentysomething nerds, but highly professional, highly skilled operators. They are part of sophisticated networks, even city-states, bent not on just demonstrating that they can get into a system, but on destroying an organization from the inside out - and reaping millions in revenue as a result.