If you need more evidence that we are living in an increasingly internet-connected world, look no further than a recent software update aimed at making sure 465,000 people with pacemakers don’t have hearts that are vulnerable to hackers. 
 
 The U.S. Food and Drug Administration announced this week that medical device company Abbott has issued a corrective action for implantable cardiac pacemakers made under the St. Jude’s Medical brand. According to the company there is a “risk of patient harm due to potential exploitation of cybersecurity vulnerabilities.” 
 
 To address this heart-hacking vulnerability, Abbott is issuing a firmware update to the pacemakers. 
 
 While this update is being treated as a recall, the devices will continue to function as intended “and replacement of implanted pacemaker devices is not recommended.” 
 
 To that end, there are no known reports of patient harm related to the cybersecurity vulnerabilities in the 465,000 radio-frequency-enabled implanted Abbott devices impacted in the U.S.; the company says this firmware update is part of a plan announced in January, and will “provide an additional layer of security against unauthorized access to these devices.” 
 
 Which devices are involved? 
 
 Included in the update: 
 
 • Accent 
 
 • Anthem 
 
 • Accent MRI 
 
 • Accent ST 
 
 • Assurity 
 
 • Allure 
 
 Not included: Any implantable cardiac defibrillators (ICDs) or cardiac resynchronization ICDs (CRT-Ds) 
 
 Going forward, any pacemaker manufactured as of Aug. 28, 2017 will have the update pre-loaded in the device. 
 
 How to get the update 
 
 If you have an impacted pacemaker, you should talk with your physician about when you should receive the update — which requires an in-person patient visit — as well as address any questions or concerns you might have. 
 
 The process will take about three minutes to complete, during which time the device will operate in backup mode “and essential, life-sustaining features will remain available.” 
 
 If you have any questions or want additional information, check out www.sjm.com/cyberupdate, or contact Abbott’s hotline at 1-800-722-3774. 
 
 “As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect how a medical device operates,” the FDA notes. ||||| Date Issued 
 
 August 29, 2017 
 
 Audience 
 
 Patients with a radio frequency (RF)-enabled St. Jude Medical implantable pacemaker 
 
 Caregivers of patients with an RF-enabled St. Jude Medical implantable cardiac pacemaker 
 
 Cardiologists, electrophysiologists, cardiothoracic surgeons, and primary care physicians treating patients with heart failure or heart rhythm problems using an RF-enabled St. Jude Medical implantable cardiac pacemaker 
 
 Medical Specialties 
 
 Cardiac Electrophysiology, Cardiology, Cardiothoracic Surgery, Heart Failure 
 
 Devices 
 
 Abbott's (formerly St. Jude Medical's) implantable cardiac pacemakers, including cardiac resynchronization therapy pacemaker (CRT-P) devices, provide pacing for slow or irregular heart rhythms. These devices are implanted under the skin in the upper chest area and have connecting insulated wires called "leads" that go into the heart. A patient may need an implantable cardiac pacemaker if their heartbeat is too slow (bradycardia) or needs resynchronization to treat heart failure. 
 
 The devices addressed in this communication are the following St. Jude Medical pacemaker and CRT-P devices: 
 
 Accent 
 
 Anthem 
 
 Accent MRI 
 
 Accent ST 
 
 Assurity 
 
 Allure 
 
 This communication does NOT apply to any implantable cardiac defibrillators (ICDs) or to cardiac resynchronization ICDs (CRT-Ds). 
 
 Purpose 
 
 On August 23, 2017, the FDA approved a firmware update that is now available and is intended as a recall, specifically a corrective action, to reduce the risk of patient harm due to potential exploitation of cybersecurity vulnerabilities for certain Abbott (formerly St. Jude Medical) pacemakers. "Firmware" is a specific type of software embedded in the hardware of a medical device (e.g. a component in the pacemaker). 
 
 For the purposes of this safety communication, cybersecurity focuses on protecting patients' medical devices and their associated computers, networks, programs, and data from unintended or unauthorized access, change, or destruction. 
 
 The FDA recommends that patients and their health care providers discuss the risks and benefits of the cybersecurity vulnerabilities and the associated firmware update designed to address such vulnerabilities at their next regularly scheduled visit. 
 
 Summary of Problem and Scope 
 
 Many medical devices - including St. Jude Medical's implantable cardiac pacemakers - contain configurable embedded computer systems that can be vulnerable to cybersecurity intrusions and exploits. As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect how a medical device operates. 
 
 The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's RF-enabled implantable cardiac pacemakers and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user (i.e. someone other than the patient's physician) to access a patient's device using commercially available equipment. This access could be used to modify programming commands to the implanted pacemaker, which could result in patient harm from rapid battery depletion or administration of inappropriate pacing. 
 
 There are no known reports of patient harm related to the cybersecurity vulnerabilities in the 465,000 (US) implanted devices impacted. 
 
 To address these cybersecurity vulnerabilities and improve patient safety, St. Jude Medical has developed and validated this firmware update as a corrective action (recall) for all of their RF-enabled pacemaker devices, including cardiac resynchronization pacemakers. The FDA has approved St. Jude Medical's firmware update to ensure that it addresses these cybersecurity vulnerabilities, and reduces the risk of exploitation and subsequent patient harm. 
 
 After installing this update, any device attempting to communicate with the implanted pacemaker must provide authorization to do so. The Merlin Programmer and Merlin@home Transmitter will provide such authorization. 
 
 The firmware update will be available beginning August 29, 2017. Pacemakers manufactured beginning August 28, 2017 will have this update pre-loaded in the device and will not need the update. 
 
 Firmware Update Details 
 
 The firmware update requires an in-person patient visit with a health care provider – it cannot be done from home via Merlin.net. The update process will take approximately 3 minutes to complete. During this time, the device will operate in backup mode (pacing at 67 beats per minute), and essential, life-sustaining features will remain available. At the completion of the update, the device will return to its pre-update settings. 
 
 As with any firmware update, there is a very low risk of an update malfunction. Based on St. Jude Medical's previous firmware update experience, installing the updated firmware could potentially result in the following malfunctions (including the rate of occurrence previously observed): 
 
 reloading of previous firmware version due to incomplete update (0.161 percent), 
 
 loss of currently programmed device settings (0.023 percent), 
 
 loss of diagnostic data (none reported), or 
 
 complete loss of device functionality (0.003 percent). 
 
 Recommendations for Health Care Providers: 
 
 The FDA and Abbott do NOT recommend prophylactic removal and replacement of affected devices. 
 
 Discuss the risks and benefits of the cybersecurity vulnerabilities and associated firmware update with your patients at the next regularly scheduled visit. As part of this discussion, it is important to consider each patient's circumstances, such as pacemaker dependence, age of the device, and patient preference, and provide them with Abbott's Patient Guide. 
 
 Determine if the update is appropriate for the given patient based on the potential benefits and risks. If deemed appropriate, install the firmware update following the instructions on the programmer. For pacing dependent patients, consider performing the cybersecurity firmware update in a facility where temporary pacing and pacemaker generator can be readily provided. 
 
 Print or digitally store the programmed device settings and the diagnostic data in case of loss during the update. 
 
 After the update, confirm that the device maintains its functionality, is not in backup mode, and that the programmed parameters have not changed. 
 
 The firmware update process is described in Abbott's Dear Doctor Letter issued on August 28, 2017. 
 
 Contact your Abbott representative, or Abbott's customer technical support hotline at 1‐800‐722‐3774 if you have any questions about the firmware update. 
 
 Recommendations for Patients and Caregivers 
 
 Consult with your physician(s) for determining when you should receive the update and if you have any questions or concerns about the vulnerabilities or the update. Your ongoing medical management should be based on your own medical history and clinical condition. 
 
 Visit www.sjm.com/cyberupdate, or contact Abbott's hotline at 1-800-722-3774 for additional information, or if you have any questions or issues regarding your St. Jude Medical implantable cardiac pacemaker. 
 
 FDA Actions 
 
 The FDA will continue to assess new information concerning the cybersecurity of Abbott's implantable cardiac devices and the Merlin@home Transmitter, and will keep the public informed if the FDA's recommendations change. 
 
 The FDA reminds patients, patient caregivers, and health care providers that any medical device connected to a communications network (e.g. wi-fi, public or home Internet) may have cybersecurity vulnerabilities that could be exploited by unauthorized users. However, the increased use of wireless technology and software in medical devices can also often offer safer, more efficient, convenient, and timely health care delivery. 
 
 The FDA will continue its work with manufacturers and health care delivery organizations—as well as security researchers and other government agencies—to develop and implement solutions to address cybersecurity issues throughout a device's total product lifecycle. The FDA takes reports of vulnerabilities in medical devices very seriously and has issued recommendations to manufacturers for continued monitoring, reporting, and remediation of medical device cybersecurity vulnerabilities. 
 
 Reporting Problems to the FDA 
 
 Prompt reporting of adverse events can help the FDA identify and better understand the risks related to the use of medical devices. If you suspect or experience a problem with these devices, we encourage you to file a voluntary report through MedWatch, the FDA Safety Information and Adverse Event Reporting program. Health care personnel employed by facilities that are subject to the FDA's user facility reporting requirements should follow the reporting procedures established by their facilities. 
 
 Additional Resources 
 
 Contact Information 
 
 If you have questions about this communication, please contact the Division of Industry and Consumer Education (DICE) at DICE@FDA.HHS.GOV, 800-638-2041 or 301-796-7100. ||||| BOSTON Barnaby Jack, a celebrated computer hacker who forced bank ATMs to spit out cash and sparked safety improvements in medical devices, died in San Francisco, a week before he was due to make a high-profile presentation at a hacking conference. 
 
 The New Zealand-born Jack, 35, was found dead on Thursday evening by "a loved one" at an apartment in San Francisco's Nob Hill neighborhood, according to a police spokesman. He would not say what caused Jack's death but said police had ruled out foul play. 
 
 The San Francisco Medical Examiner's Office said it was conducting an autopsy, although it could be a month before the cause of death is determined. 
 
 Jack was one of the world's most prominent "white hat" hackers - those who use their technical skills to find security holes before criminals can exploit them. 
 
 His genius was finding bugs in the tiny computers embedded in equipment, such as medical devices and cash machines. He often received standing ovations at conferences for his creativity and showmanship while his research forced equipment makers to fix bugs in their software. 
 
 Jack had planned to demonstrate his techniques to hack into pacemakers and implanted defibrillators at the Black Hat hackers convention in Las Vegas next Thursday. He told Reuters last week that he could kill a man from 30 feet away by attacking an implanted heart device. 
 
 "He was passionate about finding security bugs before the bad guys," said long-time security industry executive Stuart McClure, who gave Jack one of his first jobs and also had worked with him at Intel Inc's McAfee, the computer security company. 
 
 "He was one of those people who was put on this earth to find vulnerabilities that can be exploited in a malicious way to hurt people," McClure said. 
 
 Jack became one of the world's most famous hackers after a 2010 demonstration of "Jackpotting" - getting ATMs to spew out bills. (reut.rs/gIGXVq) A clip of his presentation has been viewed more than 2.6 million times on YouTube. 
 
 Two years ago, Jack turned his attention to medical devices, while working on a team at McAfee that engineered methods for attacking insulin pumps. Their research prompted medical device maker Medtronic Inc to revamp the way it designs its products. (reut.rs/sM9mTE) 
 
 The U.S. government also noticed Jack's work. 
 
 "The work that Barnaby Jack and others have done to highlight some of these vulnerabilities has contributed importantly to progress in the field," said William Maisel, deputy director for science at the Food and Drug Administration's Center for Devices and Radiological Health. 
 
 Jack's passion for hacking sometimes got him into trouble. 
 
 In 2012, he connected his laptop to a gold bullion dispensing machine at a casino in Abu Dhabi, according to fellow hacker Tiffany Strauchs Rad. She said Jack had permission from a hotel manager to hack the machine but security intervened. 
 
 It turned out the hotel did not actually own the gold machine and the American Embassy had to be called in to help resolve the misunderstanding, Rad said. 
 
 "He would hack everything he touched, she said. 
 
 "BELOVED PIRATE" 
 
 Jack's most recent employer, the cyber security consulting firm IOActive Inc, said on its Twitter account: "Lost but never forgotten our beloved pirate, Barnaby Jack has passed." 
 
 Jack had been scheduled to present his research on heart devices at Black Hat on August 1. Last week, Jack told Reuters he had devised a way to hack into a wireless communications system that linked implanted pacemakers and defibrillators with bedside monitors that gather information about their operations. 
 
 "I'm sure there could be lethal consequences," Jack said in a phone interview. 
 
 He declined to name the manufacturer of the device but said he was working with that company to figure out how to prevent malicious attacks on heart patients. 
 
 Jack's sudden death drew responses from the hacking community reminiscent of those that followed the suicide of hacker activist Aaron Swartz in January. 
 
 Dan Kaminsky, a well-known hacker, described the death as a tragedy. "Barnaby was one of the most creative, energetic, diverse researchers in our field," he said. 
 
 "You'll be missed, bro," tweeted another well-known hacker Dino Dai Zovi. 
 
 Jack's sister, Amberleigh Jack, who lives in New Zealand, told Reuters her brother was 35 years old. She declined to comment further, saying she needed time to grieve. 
 
 Black Hat said that it will not replace Jack's session at the conference, saying the hour would be left vacant for conference attendees to commemorate his life and work. 
 
 (Reporting by Jim Finkle; Editing by Tiffany Wu, Vicki Allen and Bill Trott)
– Is it a recall? Is it a software update? Well, it's actually both. Abbott, the medical device company that produces implantable cardiac pacemakers under the St. Jude’s Medical brand, has issued a "corrective action," per the Food and Drug Administration, to mitigate what it calls the "risk of patient harm due to potential exploitation of cybersecurity vulnerabilities." That's right, it's asking 465,000 people with certain devices to visit their doctors and get a firmware update so that their implants are not so easy to hack into. They say patients should schedule a visit with their doctor, and that the process will take three minutes start to finish, during which time all essential features will run in backup mode, reports Consumerist. It's unclear how many people in other countries are affected. Over the past decade, there's been an increase in reports of serious vulnerabilities in pacemakers, insulin pumps, and other medical devices, reports Ars Technica. That's because they're now outfitted with tiny radio-frequency equipment for remote maintenance that no longer requires new and costly surgeries when the devices need updating. Back in May, Engadget reported that security company WhiteScope found 8,000 bugs hackers could exploit in pacemaker programs alone. While attackers must be within 50 feet of the device to hack into it, and no one has yet to die from a cyber attack, some argue that the mere threat of an attack is reason enough to make these devices as sophisticated and protected as possible. (One pacemaker was used in an arson investigation.)