Press Releases and Statements

On October 1, the US Food and Drug Administration (FDA) issued a Safety Communication regarding a set of cybersecurity vulnerabilities, referred to as “Urgent/11” that — if exploited by a remote attacker — may introduce risks for medical devices and hospital networks. According to the communication: “These vulnerabilities may allow anyone to remotely take control of the medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent device function.” These vulnerabilities exist in a third-party software component known as IPnet

The work ‘Security Testing of the Pacemaker Ecosystem’ was recently published as a master’s thesis, authored by Mr. Anders Been Wilhelmsen and Mr. Eivind Skjelmo Kristiansen. This publication investigates the state of cybersecurity of BIOTRONIK’s ICS 3000 – a programmer for BIOTRONIK implantable cardiac pacemakers, defibrillators and monitors that is used by healthcare professionals during the implantation procedure and follow-ups. ICS 3000 programmers were distributed between 2001 and 2012. In the publication, the authors report about several cybersecurity weaknesses such as: The central

The Department of Homeland Security and the US FDA have issued a Medical Advisory and Safety Communication respectively describing two types of cybersecurity vulnerabilities affecting multiple Medtronic devices that utilize the Conexus telemetry protocol. BIOTRONIK utilizes substantially different protocols for both the clinical and the home environment. Moreover, by design, the remote communication system via BIOTRONIK Home Monitoring® does not have the functionality to transmit or alter therapeutic commands to the implant.

On October 11, the US Food and Drug Administration (FDA) issued a Safety Communication regarding cybersecurity updates affecting Medtronic implantable cardiac device programmers, based on an NCCIC Advisory. 1 According to the FDA’s communication, Medtronic is issuing a software update to address a safety risk caused by cybersecurity vulnerabilities associated with the internet connection in two models of programmers used to download software from the manufacturer’s software distribution network (SDN). Successful exploitation of these vulnerabilities would allow an adversary to influence this

On August 9, WIRED magazine reported that researchers discovered cybersecurity vulnerabilities in the way pacemaker programmers connected to the software delivery network of a specified manufacturer. The researchers claim that “digital code signing”—the cryptographic validation of the legitimacy and integrity of software—is lacking in the manufacturer’s infrastructure, allowing an attacker to potentially take control of device programmers through malicious updates that can subsequently be spread to implanted pacemakers. 1 None of BIOTRONIK’s devices, programmers or networks are affected by