Topic starter
06/11/2026 6:38 pm
TL;DR: Hospital image archives remain reachable from the public internet despite decades of DICOM security options, according to Crayonic, with researchers finding 3,627 DICOM servers in more than 100 countries and 99.56% accepting connections without checking the caller's AE title. The control gap is governance, not technology: imaging systems are still treated like back-office appliances instead of front doors.
Editorial analysis by NHI Mgmt Group, based on content published by Crayonic: “The scan is on the internet: why hospital image servers still answer strangers”.
By the numbers:
- Researchers found 3,627 DICOM servers in more than 100 countries answering anyone who asked.
- Only 0.14% were seen using TLS.
- 99.56% accepted connections without checking the caller's application entity title.
Key questions
Q: What should teams do first when a PACS or DICOM server is exposed?
A: First isolate the reachable imaging endpoint, remove any direct internet exposure, and confirm whether the PACS or DICOM server is intended to accept external associations at all.
Q: Why is AE title not enough for DICOM access control?
A: AE Title is only a DICOM application identifier, not an access control mechanism.
Q: How should hospitals secure remote access to medical image archives?
A: Hospitals should secure remote access to medical image archives with strong user authentication, MFA, encrypted connections, least privilege, and time-limited role-based access to the archive application and file shares.
Practitioner guidance
- Inventory every exposed imaging endpoint Scan internal and external address space for DICOM listeners and the web viewers attached to them, then reconcile what you find against the asset register and vendor-run instances.
- Remove public internet exposure from PACS Place image archives behind a firewall or VPN where possible, and require a deliberate access path instead of direct public reachability.
- Replace label-based trust with real authentication Use certificate-based authentication and strong identity provider controls for viewers, teleradiology portals and vendor engineers, not AE title checks alone.
Bottom line: Exposed imaging archives persist because optional protocol security, weak caller identity and generous defaults create a durable access gap.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Imaging exposure is an identity governance failure, not just a network hygiene issue. DICOM environments often have a real access model, but it is fragmented across scanners, archives, viewers and vendor connections. When identity is reduced to a text label or a local configuration choice, the organisation loses the ability to govern who can reach the archive at all. The right lens is lifecycle control over every system that can read or serve images.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the best way to govern vendor access to PACS systems?
A: The best way to govern vendor access to PACS systems is to give each vendor a unique, named account with least privilege, MFA, and JIT elevation only for approved support tasks. Access should be time bound, session recorded, tied to a ticket, and removed when the contract or maintenance need ends. Shared accounts should be avoided.
👉 Read our full editorial: Exposed DICOM servers keep hospital image archives open to strangers