In October 2019, researchers at SINTEF provided a report to BIOTRONIK describing potential cybersecurity concerns associated with CardioMessenger II devices which are no longer available on the market. We would like to reassure patients, healthcare providers and physicians that these devices are safe and can continue to be used as intended.

The US FDA issued a Safety Communication regarding a set of cybersecurity vulnerabilities, referred to as “Urgent/11” that—if exploited by a remote attacker—may introduce risks for medical devices and hospital networks. These vulnerabilities exist in a third-party software component known as IPnet, which supports network communications between computers. BIOTRONIK’s medical devices, systems and networks do not incorporate IPnet and are therefore not affected by these vulnerabilities.

The work ‘Security Testing of the Pacemaker Ecosystem’ was recently published as a master’s thesis. This publication investigates the state of cybersecurity of BIOTRONIK’s ICS 3000 programmer. The central thesis of this publication is based on programmer software and not the programmer hardware. The authors inspected the programmer software PSW 1004.U which was released in February 2011. Since the publication inspects outdated, eight-year-old software, cybersecurity measures implemented after 2011 are not considered.

On March 21, 2019, the Department of Homeland Security and the US FDA issued a Medical Advisory and Safety Communication respectively describing two types of cybersecurity vulnerabilities affecting multiple Medtronic devices that utilize the Conexus telemetry protocol. BIOTRONIK utilizes substantially different protocols for both the clinical and the home environment. Moreover, by design, the remote communication system via BIOTRONIK Home Monitoring does not have the functionality to transmit or alter therapeutic commands to the implant.

On October 11, the US Food and Drug Administration (FDA) issued a Safety Communication regarding cybersecurity updates affecting Medtronic implantable cardiac device programmers, based on an NCCIC Advisory. The FDA’s Safety Communication refers to several vulnerabilities in Medtronic’s implantable cardiac device programmers.None of BIOTRONIK’s devices, programmers or networks are affected by these cybersecurity vulnerabilities or the corrective measures that have been subsequently taken. Neither are any corrective measures necessary for BIOTRONIK’s devices.

On August 9, WIRED magazine reported that researchers discovered cybersecurity vulnerabilities in the way pacemaker programmers connected to the software delivery network of a specified manufacturer. The researchers claim that “digital code signing”—the cryptographic validation of the legitimacy and integrity of software—is lacking in the manufacturer’s infrastructure, allowing an attacker to potentially take control of device programmers through malicious updates that can subsequently be spread to implanted pacemakers.