Muddy Waters Report: St. Jude Medical’s Cardiac Devices Vulnerable to Cyber Attacks | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Muddy Waters Report: St. Jude Medical’s Cardiac Devices Vulnerable to Cyber Attacks

August 29, 2016
by Rajiv Leventhal
| Reprints

St. Jude Medical, a Minnesota-based global medical device manufacturer, saw its shares drop last week after a Muddy Waters Capital report noted demonstrations of cyber attacks to two of the company’s cardiac devices.

According to an Aug. 25th report from CNBC, shares briefly fell more than 8 percent on that day, but ended up recovering though still finishing the day down 5 percent. Meanwhile, the report from the short selling firm Muddy Waters said they have seen demonstrations of two types of cyber attacks against St. Jude’s implantable cardiac devices: a “crash” attack that causes cardiac devices to malfunction—including by apparently pacing at a potentially dangerous rate; and, a battery drain attack that could be particularly harmful to device dependent users. The report from Muddy Waters admitted that the firm has no experience in cybersecurity, but nonetheless was able replicate in-house key exploits that help to enable these attacks.

The firm’s report stated that, “Based on conversations with industry experts, we estimate remediation would take at least two years. Even lacking a recall, the product safety issues we present in this report offer unnecessary health risks and should receive serious notice among hospitals, physicians and cardiac patients.”

What’s more, the report noted that the devices’ vulnerabilities are more worrying than the medical device hacks that have been publicly discussed in the past. “These attacks take less skill, can be directed randomly at any STJ Cardiac Device within a roughly 50 foot radius, theoretically can be executed on a very large scale, and most gallingly, are made possible by the hundreds of thousands of substandard home monitoring devices STJ has distributed,” the report stated. “The STJ ecosystem, which consists of Cardiac Devices, STJ’s network, physician office programmers, and home monitoring devices, has significant vulnerabilities. These vulnerabilities highly likely could be exploited for numerous other types of attacks,” it concluded.

In a Bloomberg report, Phil Ebeling, St. Jude’s chief technology officer, insisted that “The allegations are absolutely untrue.” He added, “There are several layers of security measures in place. We conduct security assessments on an ongoing basis and work with external experts specifically on Merlin@home and on all our devices.” Even so, the Bloomberg report predicted that if proven, the company’s planned purchase by Abbott Laboratories “could be derailed.”

Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Survey: Infrastructure, Interoperability Key Barriers to Global HIT Development

A new survey report from Black Book Research on global healthcare IT adoption and records systems connectivity finds nations in various phases of regional electronic health record (EHR) adoption. The survey results also reveal rapidly advancing opportunities for U.S.-based and local technology vendors.

Penn Medicine Opens Up Telehealth Hub

Philadelphia-based Penn Medicine has opened its Center for Connected Care to centralize the health system’s telemedicine activities.

Roche to Pay $1.9B for Flatiron Health

Switzerland-based pharmaceutical company Roche has agreed to pay $1.9 billion to buy New York-based Flatiron Health Inc., which has both an oncology EHR and data analytics platform.

Financial Exec Survey: Interoperability Key Obstacle to Value-Based Payment Models

Momentum continues to grow for value-based care as nearly three-quarters of healthcare executives report their organizations have achieved positive financial results from value-based payment programs, to date, according to a new study from the Healthcare Financial Management Association (HFMA).

Cerner, Children's National to Help UAE Pediatric Center with Health IT

Al Jalila Children's Specialty Hospital, the only pediatric hospital in the United Arab Emirates, has entered into an agreement with Washington, D.C.-based Children's National Health System to form a health IT strategic partnership.

Telemedicine Association Names New CEO

The American Telemedicine Association (ATA) has named Ann Mond Johnson its new CEO, replacing Jon Linkous who stepped down suddenly last August after 24 years as the organization’s CEO.