St. Jude releasing patches to protect pacemakers from hackers
Users of St. Jude Medical’s implantable heart devices can go to bed tonight with a little less fear they’ll get hacked.
St. Jude, now under control of Abbott Laboratories, said Monday that it is releasing cyber-security patches for the Merlin monitoring system used with its pacemakers and defibrillator devices.
St. Jude’s announcement came as the Food and Drug Administration warned Monday about “vulnerabilities” in St. Jude devices that could allow hackers to break into pacemakers, resulting in battery depletion or “inappropriate pacing or shocks.”
The FDA said it reviewed St. Jude’s software patch to ensure that it takes care of the “greatest risks” posed by the devices and cuts further “risk of exploitation and subsequent patient harm.”
“There have been no reports of patient harm related to these cybersecurity vulnerabilities,” the FDA said.
The news comes five months after short-selling firm Muddy Waters called out the safety of the devices. The FDA’s findings mirrored those of Muddy Waters.
“This long-overdue acknowledgment, just days after completion of St. Jude’s sale to Abbott Laboratories, reaffirms our belief that the company puts profits over patients,” Carson Block of Muddy Waters said.
“It also reaffirms our belief that had we not gone public, St. Jude would not have remediated the vulnerabilities.”
When Muddy Water’s announced its short position on St. Jude in August, the company denied Muddy Waters’ claims. St. Jude even sued Muddy Waters in September, accusing it of orchestrating a “willful and malicious scheme to manipulate the securities markets for their own financial windfall.”
Undeterred by the suit, Muddy Waters a month later launched a website called Profits Over Patients, which had videos that claimed to show the heart devices being hacked.
Shares of St. Jude’s no longer trade since being acquired by Abbott in a $25 billion deal earlier this month, putting the potential gain of Muddy Waters’ short position into question.
Despite its seeming moral win, Block said Monday’s announcement still fails to fix “larger problems, including the existence of a universal code that could allow hackers to control the implants.”