FDA Issues Recall on Pacemakers Due to Security Vulnerabilities
The FDA issued a security advisory, warning that the pacemakers must be recalled on a voluntary basis. The devices are much “smarter” than previous models, opening up the possibilities of being tampered with by cyber criminals.
Pacemakers by Abbott (formerly St. Jude Medical) have been recalled by the U.S. Food and Drug Administration due to security vulnerabilities – prompting an estimated 465,000 patients with heart conditions across the country to need to visit their doctor to have theirs updated.
The FDA issued a security advisory, warning that the pacemakers must be recalled on a voluntary basis. The devices are much “smarter” than previous models, opening up the possibilities of being tampered with by cyber criminals.
The pacemakers need to be given a firmware update to protect them against vulnerabilities which could drain battery life, allow hackers to change programmed settings or even change its beats and rhythm.
This poses a problem – seeing as the recalled devices are embedded in patients’ chests.
In a letter sent to doctors, Abbott admitted that the update, approved by the FDA on August 23, could not be delivered over the air and will require about three minutes in the presence of the patient to download and install while in backup mode.
Patients are asked to contact their doctors to book themselves an appointment to get the update. However, in the letter, doctors are advised by Abbott to update only if it is "appropriate given the risk of update for the patient."
Patients with a RF-enabled St. Jude pacemaker or cardiac pacemaker, as well as healthcare professionals who are using these devices presently in hospitals to treat conditions including heart failure and irregular heart rhythms, must make sure a firmware update is applied to these devices. This specifically includes the Accent, Anthem, Accent MRI, Accent ST, Assurity and Allure models.
"The FDA reminds patients, patient caregivers, and health care providers that any medical device connected to a communications network (e.g. Wi-Fi, public or home Internet) may have cybersecurity vulnerabilities that could be exploited by unauthorized users," the FDA said in its announcement. "However, the increased use of wireless technology and software in medical devices can also often offer safer, more efficient, convenient, and timely health care delivery."