Muddy Waters Report: St. Jude Medical’s Cardiac Devices Vulnerable to Cyber Attacks | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Muddy Waters Report: St. Jude Medical’s Cardiac Devices Vulnerable to Cyber Attacks

August 29, 2016
by Rajiv Leventhal
| Reprints

St. Jude Medical, a Minnesota-based global medical device manufacturer, saw its shares drop last week after a Muddy Waters Capital report noted demonstrations of cyber attacks to two of the company’s cardiac devices.

According to an Aug. 25th report from CNBC, shares briefly fell more than 8 percent on that day, but ended up recovering though still finishing the day down 5 percent. Meanwhile, the report from the short selling firm Muddy Waters said they have seen demonstrations of two types of cyber attacks against St. Jude’s implantable cardiac devices: a “crash” attack that causes cardiac devices to malfunction—including by apparently pacing at a potentially dangerous rate; and, a battery drain attack that could be particularly harmful to device dependent users. The report from Muddy Waters admitted that the firm has no experience in cybersecurity, but nonetheless was able replicate in-house key exploits that help to enable these attacks.

The firm’s report stated that, “Based on conversations with industry experts, we estimate remediation would take at least two years. Even lacking a recall, the product safety issues we present in this report offer unnecessary health risks and should receive serious notice among hospitals, physicians and cardiac patients.”

What’s more, the report noted that the devices’ vulnerabilities are more worrying than the medical device hacks that have been publicly discussed in the past. “These attacks take less skill, can be directed randomly at any STJ Cardiac Device within a roughly 50 foot radius, theoretically can be executed on a very large scale, and most gallingly, are made possible by the hundreds of thousands of substandard home monitoring devices STJ has distributed,” the report stated. “The STJ ecosystem, which consists of Cardiac Devices, STJ’s network, physician office programmers, and home monitoring devices, has significant vulnerabilities. These vulnerabilities highly likely could be exploited for numerous other types of attacks,” it concluded.

In a Bloomberg report, Phil Ebeling, St. Jude’s chief technology officer, insisted that “The allegations are absolutely untrue.” He added, “There are several layers of security measures in place. We conduct security assessments on an ongoing basis and work with external experts specifically on Merlin@home and on all our devices.” Even so, the Bloomberg report predicted that if proven, the company’s planned purchase by Abbott Laboratories “could be derailed.”

Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Healthcare Execs Anticipate High Cost Returns from Predictive Analytics Use

Healthcare executives are dedicating budget to predictive analytics, and are forecasting significant cost savings in return, according to new research from the Illinois-based Society of Actuaries.

Adam Boehler Tapped by Azar to Serve as Senior Value-Based Care Advisor

Adam Boehler, currently director of CMMI, has also been named the senior advisor for value-based transformation and innovation, HHS Secretary Alex Azar announced.

Vivli Launches Clinical Research Data-Sharing Platform

On July 19 a new global data-sharing and analytics platform called Vivli was unveiled. The nonprofit group’s mission is to promote, coordinate and facilitate scientific sharing and reuse of clinical research data.

Survey: More Effective IT Needed to Improve Patient Safety

In a Health Catalyst survey, physicians, nurses and healthcare executives said ineffective information technology, and the lack of real-time warnings for possible harm events, are key obstacles to achieving their organizations' patient safety goals.

Physicians Still Reluctant to Embrace Virtual Tech, Survey Finds

While consumers and physicians agree that virtual healthcare holds great promise for transforming care delivery, physicians still remain reluctant to embrace the technologies, according to a new Deloitte Center for Health Solutions survey.

Geisinger, AstraZeneca Partner on Asthma App Suite

Geisinger has partnered with pharmaceutical company AstraZeneca to create a suite of products that integrate into the electronic health record and engage asthma patients and their providers in co-managing the disease.