Cybersecurity glitch wreaks havoc on insulin pumps

FDA is warning that certain Medtronic MiniMed insulin pumps are being recalled due to potential cybersecurity risks.

 “The potential risks are related to the wireless communication between Medtronic's MiniMed insulin pumps and other devices such as blood glucose meters, continuous glucose monitoring systems, the remote controller and CareLink USB device used with these pumps,” FDA said in a statement. “The FDA is concerned that, due to cybersecurity vulnerabilities identified in the device, someone other than a patient, caregiver or health care provider could potentially connect wirelessly to a nearby MiniMed insulin pump and change the pump’s settings.”

Related: FDA Warns CBD Supplement Maker

The recalled pumps are Medtronic’s MiniMed 508 insulin pump and MiniMed Paradigm series insulin pumps. Medtronic is providing alternative insulin pumps to patients with enhanced built-in cybersecurity capabilities.

Medtronic has identified 4,000 patients who are potentially using insulin pumps that are vulnerable to this issue and is working with distributor partners to identify additional patients potentially using the pumps.

FDA is recommending that patients using these models switch their insulin pump to models that are better equipped to protect against these potential risks. However, the agency is not aware of any confirmed reports of patient harm related to these potential cybersecurity risks.

“The FDA urges manufacturers everywhere to remain vigilant about their medical products-to monitor and assess cybersecurity vulnerability risk, and to be proactive about disclosing vulnerabilities and mitigations to address them,” said Suzanne Schwartz, MD, deputy director of the Office of Strategic Partnerships and Technology Innovation and acting division director for All Hazards Response, Science and Strategic Partnerships in  FDA’s Center for Devices and Radiological Health, in the statement.

Related: FDA Warns Maker Of Ingredient In Huge Heart Drug Recall

“While we are not aware of patients who may have been harmed by this particular cybersecurity vulnerability, the risk of patient harm if such a vulnerability were left unaddressed is significant,” Schwartz added.

Any medical device connected to a communications network, like Wi-Fi, or public or home Internet, may have cybersecurity vulnerabilities that could be exploited by unauthorized users, according to Schwartz. “However, at the same time it’s important to remember that the increased use of wireless technology and software in medical devices can also offer safer, more convenient, and timely health care delivery,” she said.

Medtronic is unable to adequately update the MiniMed 508 and Paradigm insulin pumps with any software or patch to address the devices’ vulnerabilities. FDA is “working to assure that Medtronic addresses this cybersecurity issue, including helping patients with affected insulin pumps switch to newer models with better cybersecurity controls,” the agency said.

Read more: FDA Warns About Fraudulent Flu Products