Figure 1. One medical device manufacturer had 35 CVEs and 125-plus sets of exposed credentials. This word cloud, courtesy of Scott Erven, describes common default passwords from a single medical device manufacturer. Default passwords on cameras and other IoT devices enabled attackers to direct a tsunami of network traffic at Dyn. Similar default password risks exist for medical devices.