is releasing cyber security updates for its St. Jude heart devices, it
said on Monday, some five months after the U.S. government launched a
probe into claims they were vulnerable to potentially life-threatening
hacks.
The
Department of Homeland Security’s Industrial Control Systems Cyber
Emergency Response Team (ICS-CERT) said the fix does not address all
known problems affecting the company’s implanted heart devices.
“St. Jude Medical is continuing to work with
ICS-CERT and the FDA to address additional security issues that have
been identified,” the agency said in an advisory on its website.
Representatives for ICS-CERT, the Food and Drug
Administration and Abbott could not be reached immediately to comment on
the remaining problems.
ICS-CERT issued its advisory after the FDA
released a Safety Communication advising patients and physicians that
they could continue to using St. Jude’s implanted cardiac devices
following the updates. ICS-CERT is charged with improving security of
technologies in healthcare, energy and other industries that are part of
critical infrastructure.
The FDA confirmed claims that cyber
“vulnerabilities” could allow a hacker to remotely access St. Jude
medical devices, but said there have been no reports of patients harmed
by the vulnerabilities.
The updates will automatically be pushed out to St. Jude home monitors that enable doctors to track their performance.
Doctors
and patients have been waiting for the FDA and St. Jude to act since
August when short-selling firm Muddy Waters and cyber security firm Med Sec Holdings claimed the implanted heart devices were riddled with
potentially lethal security bugs.
They
warned of two primary hacks: One that could cause implanted devices to
pace at potentially dangerous rates and one that drains the
batteries.The FDA said it will continue to assess new information
concerning the devices and alert the public if it recommends further
changes.
“The FDA
conducted an assessment of the benefits and risks of using the
Merlin@home Transmitter, and has determined that the health benefits to
patients from continued use of the device outweigh the cyber security
risks,” the agency said.
Merlin is used with its implantable pacemakers and defibrillator devices.
When
Muddy Waters went public with the allegations in August, it also
disclosed it was shorting St. Jude Medical, which was preparing to sell
itself to Abbott.
Muddy
Waters said it believed that disclosure of the vulnerabilities could
cause the $25 billion deal to fall apart, but Abbott last week completed
its acquisition of St. Jude, one of the world’s biggest makers of
implantable cardiac devices.
