FDA alerts to recall of half million pacemakers over hacking concerns

The Food and Drug Administration (FDA) is alerting the public to a voluntary recall of nearly half a million pacemakers over software vulnerabilities that could allow hackers to gain access to the devices and potentially cause harm to their users. 

The government body issued a safety alert this week saying the company Abbott, formerly known as St. Jude Medical, is taking “corrective action” and recalling 465,000 radio frequency-enabled implantable pacemakers. 

{mosads}

“The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical’s RF-enabled implantable cardiac pacemakers and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user (i.e. someone other than the patient’s physician) to access a patient’s device using commercially available equipment,” the FDA said. 

“This access could be used to modify programming commands to the implanted pacemaker, which could result in patient harm from rapid battery depletion or administration of inappropriate pacing,” the safety communication said. 

The voluntary recall covers several devices, including the Accent, Anthem, Accent MRI, Accent ST, Assurity and Allure. 

The FDA says there are no known reports of patients enduring harm as a result of the cyber vulnerabilities in the device software. 

The company has developed a firmware update for all affected pacemakers, which has been approved by the FDA. Individuals whose devices are included in the recall need to visit their health care providers to initiate the update. The FDA is not recommending that the devices be removed and replaced.

There have been heightened concerns of hacking risks to medical devices as they have increasingly become connected to the internet.

The FDA has a history of scrutinizing cybersecurity vulnerabilities in devices made by St. Jude Medical, acquired by Abbott in January. The administration issued a warning letter to Abbott in April pressing the company to address security issues in cardiac devices made by St. Jude Medical.

Updated: 6:23 p.m.