Skip to content Skip to navigation

Muddy Waters Report: St. Jude Medical’s Cardiac Devices Vulnerable to Cyber Attacks

August 29, 2016
by Rajiv Leventhal
| Reprints

St. Jude Medical, a Minnesota-based global medical device manufacturer, saw its shares drop last week after a Muddy Waters Capital report noted demonstrations of cyber attacks to two of the company’s cardiac devices.

According to an Aug. 25th report from CNBC, shares briefly fell more than 8 percent on that day, but ended up recovering though still finishing the day down 5 percent. Meanwhile, the report from the short selling firm Muddy Waters said they have seen demonstrations of two types of cyber attacks against St. Jude’s implantable cardiac devices: a “crash” attack that causes cardiac devices to malfunction—including by apparently pacing at a potentially dangerous rate; and, a battery drain attack that could be particularly harmful to device dependent users. The report from Muddy Waters admitted that the firm has no experience in cybersecurity, but nonetheless was able replicate in-house key exploits that help to enable these attacks.

The firm’s report stated that, “Based on conversations with industry experts, we estimate remediation would take at least two years. Even lacking a recall, the product safety issues we present in this report offer unnecessary health risks and should receive serious notice among hospitals, physicians and cardiac patients.”

What’s more, the report noted that the devices’ vulnerabilities are more worrying than the medical device hacks that have been publicly discussed in the past. “These attacks take less skill, can be directed randomly at any STJ Cardiac Device within a roughly 50 foot radius, theoretically can be executed on a very large scale, and most gallingly, are made possible by the hundreds of thousands of substandard home monitoring devices STJ has distributed,” the report stated. “The STJ ecosystem, which consists of Cardiac Devices, STJ’s network, physician office programmers, and home monitoring devices, has significant vulnerabilities. These vulnerabilities highly likely could be exploited for numerous other types of attacks,” it concluded.

In a Bloomberg report, Phil Ebeling, St. Jude’s chief technology officer, insisted that “The allegations are absolutely untrue.” He added, “There are several layers of security measures in place. We conduct security assessments on an ongoing basis and work with external experts specifically on Merlin@home and on all our devices.” Even so, the Bloomberg report predicted that if proven, the company’s planned purchase by Abbott Laboratories “could be derailed.”

Get the latest information on Cybersecurity and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Trump Administration Appoints Peter Severino to Head Office for Civil Rights

Roger Severino, a former staffer at The Heritage Foundation, has been appointed as the director of the Office of Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS).

ACP: EHRs Have Great Benefits, but Raise Ethical Questions, Too

Electronic health records (EHRs) should facilitate high value patient-centered care, strong patient-physician relationships, and effective training of future physicians, but they also raise ethical questions, the ACP wrote.

Allegheny Health Network, VA Pittsburgh Integrate EMR Systems

Allegheny Health Network (AHN), based in Pittsburgh, and VA Pittsburgh Healthcare System (VAPHS), have announced the successful integration of their electronic medical record (EMR) platforms.

Wisconsin Urology Group Notifies Patients of Data Breach Due to Ransomware Attack

Wauwatosa, Wis.-based Metropolitan Urology Group has notified its patients of a breach of unsecured patient health information due to a ransomware attack back in November 2016.

Study: For Post-Op Patients, Mobile Apps for Follow-Up Care Led to Fewer In-Person Visits

For patients undergoing ambulatory surgery, those who used a mobile app for follow-up care attended fewer in-person visits post- operation than patients who did not use the app, according to a study in JAMA Surgery.

Information Blocking is Routine and Fairly Widespread, Survey of HIEs Finds

In a survey, 50 percent of HIE leaders said electronic health record (EHR) vendors "routinely" engage in information blocking, and 25 percent reported that hospitals and health systems routinely engage in business practices that interfere with electronic health information exchange.