Medtronic recalls insulin pumps over cybersecurity risk

Could be vulnerable to hackers taking control of devices

Medtronic is recalling several models of its insulin pumps after the Food and Drug Administration warned patients and healthcare providers that the devices are vulnerable to cyber threats that could lead to serious health risks.

The recall affects Medtronic’s MiniMed 508 and MiniMed Paradigm series insulin pumps, which connect wirelessly to other insulin equipment, including glucose meters, a monitoring system and controls that pump insulin. The cyber vulnerabilities could allow hackers to take control of the devices remotely and change their settings. In a statement on Thursday, the FDA said Medtronic is currently not able to “adequately update” the pumps to patch the risks.

The agency said it “is concerned that, due to cybersecurity vulnerabilities identified in the device, someone other than a patient, caregiver or health care provider could potentially connect wirelessly to a nearby MiniMed insulin pump and change the pump’s settings. This could allow a person to over deliver insulin to a patient, leading to low blood sugar … or to stop insulin delivery, leading to high blood sugar and diabetic ketoacidosis.”

It added: “Patients with diabetes using these models should switch their insulin pump to models that are better equipped to protect against these potential risks.”

Medtronic said in a letter to the 4,000 users of the devices that it recommended switching to a different type of insulin pump and taking cybersecurity precautions with the existing pumps. Security steps included making sure all devices related to the pump were kept in patients’ sight at all times and monitoring blood sugar levels closely.

Similar cybersecurity alerts have been issued by the FDA regarding medical devices, including heart defibrillators and pacemakers.

Medtronic, which is based in Dublin, Ireland, operates has a facility in Portsmouth, NH, where some 150 people are employed. The company confirmed in February that it would be closing the site at Pease International Tradeport within a year.