Manufacturers are supposed to control programmers' distribution, but the researchers themselves got their test devices from the auction website for as little as $500 to as much as $3,000. In addition to those issues, the team has found that doctors' monitoring systems don't require log-in names and passwords when pacemakers connect to them. They even found unencrypted patients' data stored in the tools, including SSNs, names, phone numbers and medical conditions. 
 
 That said, Matthew Green, an Assistant Professor for Computer Science at Johns Hopkins, noted that doctors are adamant not to let security systems block patient care. He said that requiring passwords would merely lead to a "post-it note on the device listing the password," so every doctors' staff member can access the data they need. Green also called attention to some dubious parts of the study, particularly the lack of emphasis on the team's most alarming finding that third-party programmers can remotely access pacemakers: 
 
 All of the other issues are kind of peripheral. If you can use your own hardware to send programming commands to a device... 7/n — Matthew Green (@matthew_d_green) May 24, 2017 
 
 Despite the points Green raised, it's still true that various security researchers have been warning manufacturers about pacemakers' and other cardiac devices' vulnerabilities for years. Unfortunately, it sounds like very few listened: a separate study by security firm Ponemon Institute LLC found that only 17 percent of manufacturers took steps to secure their products. While we've yet to hear about an incident that has led to a patient's death, it's still ideal to make cardiac devices more secure as cyberattacks become more common, elaborate and sophisticated. ||||| If you need more evidence that we are living in an increasingly internet-connected world, look no further than a recent software update aimed at making sure 465,000 people with pacemakers don’t have hearts that are vulnerable to hackers. 
 
 The U.S. Food and Drug Administration announced this week that medical device company Abbott has issued a corrective action for implantable cardiac pacemakers made under the St. Jude’s Medical brand. According to the company there is a “risk of patient harm due to potential exploitation of cybersecurity vulnerabilities.” 
 
 To address this heart-hacking vulnerability, Abbott is issuing a firmware update to the pacemakers. 
 
 While this update is being treated as a recall, the devices will continue to function as intended “and replacement of implanted pacemaker devices is not recommended.” 
 
 To that end, there are no known reports of patient harm related to the cybersecurity vulnerabilities in the 465,000 radio-frequency-enabled implanted Abbott devices impacted in the U.S.; the company says this firmware update is part of a plan announced in January, and will “provide an additional layer of security against unauthorized access to these devices.” 
 
 Which devices are involved? 
 
 Included in the update: 
 
 • Accent 
 
 • Anthem 
 
 • Accent MRI 
 
 • Accent ST 
 
 • Assurity 
 
 • Allure 
 
 Not included: Any implantable cardiac defibrillators (ICDs) or cardiac resynchronization ICDs (CRT-Ds) 
 
 Going forward, any pacemaker manufactured as of Aug. 28, 2017 will have the update pre-loaded in the device. 
 
 How to get the update 
 
 If you have an impacted pacemaker, you should talk with your physician about when you should receive the update — which requires an in-person patient visit — as well as address any questions or concerns you might have. 
 
 The process will take about three minutes to complete, during which time the device will operate in backup mode “and essential, life-sustaining features will remain available.” 
 
 If you have any questions or want additional information, check out www.sjm.com/cyberupdate, or contact Abbott’s hotline at 1-800-722-3774. 
 
 “As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect how a medical device operates,” the FDA notes. ||||| Date Issued 
 
 August 29, 2017 
 
 Audience 
 
 Patients with a radio frequency (RF)-enabled St. Jude Medical implantable pacemaker 
 
 Caregivers of patients with an RF-enabled St. Jude Medical implantable cardiac pacemaker 
 
 Cardiologists, electrophysiologists, cardiothoracic surgeons, and primary care physicians treating patients with heart failure or heart rhythm problems using an RF-enabled St. Jude Medical implantable cardiac pacemaker 
 
 Medical Specialties 
 
 Cardiac Electrophysiology, Cardiology, Cardiothoracic Surgery, Heart Failure 
 
 Devices 
 
 Abbott's (formerly St. Jude Medical's) implantable cardiac pacemakers, including cardiac resynchronization therapy pacemaker (CRT-P) devices, provide pacing for slow or irregular heart rhythms. These devices are implanted under the skin in the upper chest area and have connecting insulated wires called "leads" that go into the heart. A patient may need an implantable cardiac pacemaker if their heartbeat is too slow (bradycardia) or needs resynchronization to treat heart failure. 
 
 The devices addressed in this communication are the following St. Jude Medical pacemaker and CRT-P devices: 
 
 Accent 
 
 Anthem 
 
 Accent MRI 
 
 Accent ST 
 
 Assurity 
 
 Allure 
 
 This communication does NOT apply to any implantable cardiac defibrillators (ICDs) or to cardiac resynchronization ICDs (CRT-Ds). 
 
 Purpose 
 
 On August 23, 2017, the FDA approved a firmware update that is now available and is intended as a recall, specifically a corrective action, to reduce the risk of patient harm due to potential exploitation of cybersecurity vulnerabilities for certain Abbott (formerly St. Jude Medical) pacemakers. "Firmware" is a specific type of software embedded in the hardware of a medical device (e.g. a component in the pacemaker). 
 
 For the purposes of this safety communication, cybersecurity focuses on protecting patients' medical devices and their associated computers, networks, programs, and data from unintended or unauthorized access, change, or destruction. 
 
 The FDA recommends that patients and their health care providers discuss the risks and benefits of the cybersecurity vulnerabilities and the associated firmware update designed to address such vulnerabilities at their next regularly scheduled visit. 
 
 Summary of Problem and Scope 
 
 Many medical devices - including St. Jude Medical's implantable cardiac pacemakers - contain configurable embedded computer systems that can be vulnerable to cybersecurity intrusions and exploits. As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect how a medical device operates. 
 
 The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's RF-enabled implantable cardiac pacemakers and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user (i.e. someone other than the patient's physician) to access a patient's device using commercially available equipment. This access could be used to modify programming commands to the implanted pacemaker, which could result in patient harm from rapid battery depletion or administration of inappropriate pacing. 
 
 There are no known reports of patient harm related to the cybersecurity vulnerabilities in the 465,000 (US) implanted devices impacted. 
 
 To address these cybersecurity vulnerabilities and improve patient safety, St. Jude Medical has developed and validated this firmware update as a corrective action (recall) for all of their RF-enabled pacemaker devices, including cardiac resynchronization pacemakers. The FDA has approved St. Jude Medical's firmware update to ensure that it addresses these cybersecurity vulnerabilities, and reduces the risk of exploitation and subsequent patient harm. 
 
 After installing this update, any device attempting to communicate with the implanted pacemaker must provide authorization to do so. The Merlin Programmer and Merlin@home Transmitter will provide such authorization. 
 
 The firmware update will be available beginning August 29, 2017. Pacemakers manufactured beginning August 28, 2017 will have this update pre-loaded in the device and will not need the update. 
 
 Firmware Update Details 
 
 The firmware update requires an in-person patient visit with a health care provider – it cannot be done from home via Merlin.net. The update process will take approximately 3 minutes to complete. During this time, the device will operate in backup mode (pacing at 67 beats per minute), and essential, life-sustaining features will remain available. At the completion of the update, the device will return to its pre-update settings. 
 
 As with any firmware update, there is a very low risk of an update malfunction. Based on St. Jude Medical's previous firmware update experience, installing the updated firmware could potentially result in the following malfunctions (including the rate of occurrence previously observed): 
 
 reloading of previous firmware version due to incomplete update (0.161 percent), 
 
 loss of currently programmed device settings (0.023 percent), 
 
 loss of diagnostic data (none reported), or 
 
 complete loss of device functionality (0.003 percent). 
 
 Recommendations for Health Care Providers: 
 
 The FDA and Abbott do NOT recommend prophylactic removal and replacement of affected devices. 
 
 Discuss the risks and benefits of the cybersecurity vulnerabilities and associated firmware update with your patients at the next regularly scheduled visit. As part of this discussion, it is important to consider each patient's circumstances, such as pacemaker dependence, age of the device, and patient preference, and provide them with Abbott's Patient Guide. 
 
 Determine if the update is appropriate for the given patient based on the potential benefits and risks. If deemed appropriate, install the firmware update following the instructions on the programmer. For pacing dependent patients, consider performing the cybersecurity firmware update in a facility where temporary pacing and pacemaker generator can be readily provided. 
 
 Print or digitally store the programmed device settings and the diagnostic data in case of loss during the update. 
 
 After the update, confirm that the device maintains its functionality, is not in backup mode, and that the programmed parameters have not changed. 
 
 The firmware update process is described in Abbott's Dear Doctor Letter issued on August 28, 2017. 
 
 Contact your Abbott representative, or Abbott's customer technical support hotline at 1‐800‐722‐3774 if you have any questions about the firmware update. 
 
 Recommendations for Patients and Caregivers 
 
 Consult with your physician(s) for determining when you should receive the update and if you have any questions or concerns about the vulnerabilities or the update. Your ongoing medical management should be based on your own medical history and clinical condition. 
 
 Visit www.sjm.com/cyberupdate, or contact Abbott's hotline at 1-800-722-3774 for additional information, or if you have any questions or issues regarding your St. Jude Medical implantable cardiac pacemaker. 
 
 FDA Actions 
 
 The FDA will continue to assess new information concerning the cybersecurity of Abbott's implantable cardiac devices and the Merlin@home Transmitter, and will keep the public informed if the FDA's recommendations change. 
 
 The FDA reminds patients, patient caregivers, and health care providers that any medical device connected to a communications network (e.g. wi-fi, public or home Internet) may have cybersecurity vulnerabilities that could be exploited by unauthorized users. However, the increased use of wireless technology and software in medical devices can also often offer safer, more efficient, convenient, and timely health care delivery. 
 
 The FDA will continue its work with manufacturers and health care delivery organizations—as well as security researchers and other government agencies—to develop and implement solutions to address cybersecurity issues throughout a device's total product lifecycle. The FDA takes reports of vulnerabilities in medical devices very seriously and has issued recommendations to manufacturers for continued monitoring, reporting, and remediation of medical device cybersecurity vulnerabilities. 
 
 Reporting Problems to the FDA 
 
 Prompt reporting of adverse events can help the FDA identify and better understand the risks related to the use of medical devices. If you suspect or experience a problem with these devices, we encourage you to file a voluntary report through MedWatch, the FDA Safety Information and Adverse Event Reporting program. Health care personnel employed by facilities that are subject to the FDA's user facility reporting requirements should follow the reporting procedures established by their facilities. 
 
 Additional Resources 
 
 Contact Information 
 
 If you have questions about this communication, please contact the Division of Industry and Consumer Education (DICE) at DICE@FDA.HHS.GOV, 800-638-2041 or 301-796-7100.
– Is it a recall? Is it a software update? Well, it's actually both. Abbott, the medical device company that produces implantable cardiac pacemakers under the St. Jude’s Medical brand, has issued a "corrective action," per the Food and Drug Administration, to mitigate what it calls the "risk of patient harm due to potential exploitation of cybersecurity vulnerabilities." That's right, it's asking 465,000 people with certain devices to visit their doctors and get a firmware update so that their implants are not so easy to hack into. They say patients should schedule a visit with their doctor, and that the process will take three minutes start to finish, during which time all essential features will run in backup mode, reports Consumerist. It's unclear how many people in other countries are affected. Over the past decade, there's been an increase in reports of serious vulnerabilities in pacemakers, insulin pumps, and other medical devices, reports Ars Technica. That's because they're now outfitted with tiny radio-frequency equipment for remote maintenance that no longer requires new and costly surgeries when the devices need updating. Back in May, Engadget reported that security company WhiteScope found 8,000 bugs hackers could exploit in pacemaker programs alone. While attackers must be within 50 feet of the device to hack into it, and no one has yet to die from a cyber attack, some argue that the mere threat of an attack is reason enough to make these devices as sophisticated and protected as possible. (One pacemaker was used in an arson investigation.)