Medical device company Medtronic is recalling a number of insulin pumps after discovering they are vulnerable to hacks — and there’s no way to patch the security holes. The FDA announced the vulnerability in the MiniMed 508 and Paradigm pumps this week, and Medtronic has sent a letter to around 4,000 patients currently using the devices.
“The FDA is warning patients and health care providers that certain Medtronic MiniMed insulin pumps have potential cybersecurity risks,” the FDA said in its advisory. “Patients with diabetes using these models should switch their insulin pump to models that are better equipped to protect against these potential risks.”
While patients are waiting for a replacement pump, the FDA advises users to reduce the risk of cybersecurity attack by keeping their pump and connected devices on their person at all times, not sharing their pump serial numbers, and paying special attention to notifications from the pump and their glucose levels.
Concerns about the security of medical IoT (Internet of Things) devices have been raised before. Earlier this year, a white hat hacker warned that medical device manufacturers were not paying enough attention to security issues. “Manufacturers of medical IoT devices should be prioritizing security, especially considering the potential detrimental consequences of a breach,” Catherine Norcom, a hardware hacker for IBM’s X-Force Red, told Security Intelligence.
“Medical IoT devices are a top target of cybercriminals, so even if a manufacturer thinks it has developed a device with reasonable security, criminals may still find vulnerabilities. I recently read a Ponemon Institute study that said 67% of medical device makers believe an attack on one or more medical devices they have built is likely.”
The issue is not only the high possibility of an attack, but the devastating consequences that such attacks could have on users’ well-being or even their lives. But the poor security of insulin pumps has a flip side as well: diabetes patients who choose to hack their own devices to better fit their needs.
Dana Lewis, a diabetes patient from Alabama, created a program to automatically adjust the amount of insulin her pump distributed according to her blood sugar levels. She made the program available through the OpenAPS website and has said that the hack has greatly improved her quality of life. However, the FDA has warned against diabetes patients “using unauthorized devices for diabetes management” and medical professionals have seconded this warning.
