Skip to content Skip to navigation

Muddy Waters Report: St. Jude Medical’s Cardiac Devices Vulnerable to Cyber Attacks

August 29, 2016
by Rajiv Leventhal
| Reprints

St. Jude Medical, a Minnesota-based global medical device manufacturer, saw its shares drop last week after a Muddy Waters Capital report noted demonstrations of cyber attacks to two of the company’s cardiac devices.

According to an Aug. 25th report from CNBC, shares briefly fell more than 8 percent on that day, but ended up recovering though still finishing the day down 5 percent. Meanwhile, the report from the short selling firm Muddy Waters said they have seen demonstrations of two types of cyber attacks against St. Jude’s implantable cardiac devices: a “crash” attack that causes cardiac devices to malfunction—including by apparently pacing at a potentially dangerous rate; and, a battery drain attack that could be particularly harmful to device dependent users. The report from Muddy Waters admitted that the firm has no experience in cybersecurity, but nonetheless was able replicate in-house key exploits that help to enable these attacks.

The firm’s report stated that, “Based on conversations with industry experts, we estimate remediation would take at least two years. Even lacking a recall, the product safety issues we present in this report offer unnecessary health risks and should receive serious notice among hospitals, physicians and cardiac patients.”

What’s more, the report noted that the devices’ vulnerabilities are more worrying than the medical device hacks that have been publicly discussed in the past. “These attacks take less skill, can be directed randomly at any STJ Cardiac Device within a roughly 50 foot radius, theoretically can be executed on a very large scale, and most gallingly, are made possible by the hundreds of thousands of substandard home monitoring devices STJ has distributed,” the report stated. “The STJ ecosystem, which consists of Cardiac Devices, STJ’s network, physician office programmers, and home monitoring devices, has significant vulnerabilities. These vulnerabilities highly likely could be exploited for numerous other types of attacks,” it concluded.

In a Bloomberg report, Phil Ebeling, St. Jude’s chief technology officer, insisted that “The allegations are absolutely untrue.” He added, “There are several layers of security measures in place. We conduct security assessments on an ongoing basis and work with external experts specifically on Merlin@home and on all our devices.” Even so, the Bloomberg report predicted that if proven, the company’s planned purchase by Abbott Laboratories “could be derailed.”

Get the latest information on Cybersecurity and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

ECRI Institute Publishes Guidance for Protecting Medical Devices from Ransomware Attacks

The ECRI Institute has released a new guidance article, "Ransomware Attacks: How to Protect Your Medical Device Systems, with recommendations to help hospitals identify and protect against ransomware attacks.

Survey: Stakeholders Predict More Medical Device Attacks as Security Lags

Some 67 percent of medical device manufacturers and 56 percent of healthcare delivery organizations (HDOs) believe an attack on a medical device built or in use by their organizations is likely to occur over the next 12 months.

AMIA Urges FCC to Consider Access to Broadband a Social Determinant of Health

The American Medical Informatics Association (AMIA) is calling on the Federal Communication Commission’s (FCC) to b support broadband-enabled health care delivery by bolstering its efforts to better target those with chronic conditions, and ensure that those populations have access to affordable broadband and broadband-enabled health technologies.

Reports: VA Secretary Won’t Ask for IT Funding with Uncertainty Surrounding VistA

While many federal agencies saw cuts across the board in President Trump’s 2018 budget request this week, the Department of Veterans Affairs (VA) got a spending boost, albeit not related to information technology.

Mount Sinai Creates Imaging Research Warehouse

The Mount Sinai Health System in New York has created a database that integrates clinical imaging with electronic health records to allow researchers to identify new patterns in the data.

CBO Analysis Estimates House-Passed AHCA Would Leave 23 Million More Uninsured by 2026

If enacted, the American Health Care Act (AHCA) would reduce the federal deficit over the 2017-2026 period by $119 billion and increase the number of people who are uninsured by 23 million in 2026, relative to current law, according to a cost estimate by the Congressional Budget Office (CBO) and the Joint Committee on Taxation (JCT).