FDA Warns of Potential Cybersecurity Threat with Some Heart Devices

By Amy Orciari Herman

Edited by Susan Sadoughi, MD, and André Sofair, MD, MPH

The FDA has issued a warning about potential cybersecurity vulnerabilities with Medtronic's implantable cardioverter defibrillators (ICDs) and cardiac resynchronization therapy defibrillators (CRT-Ds).

In its safety communication, the agency noted that the Conexus wireless telemetry system that's used for communication across Medtronic's ICDs, CRT-Ds, clinic programmers, and home monitors "does not use encryption, authentication, or authorization." This "could allow an unauthorized individual (for example, someone other than the patient's physician) to access and potentially manipulate an implantable device, home monitor, or clinic programmer."

The FDA has not received reports of patient harm associated with these vulnerabilities.

Medtronic is working on security updates for its systems. The FDA says clinicians and patients should keep using the ICDs and CRT-Ds "as intended and follow device labeling."

A list of the potentially affected models is available at the first link below.