Drug regulator issues alert about cyber security risk in Medtronic insulin pumps

     Drug regulator issues alert about cyber security risk in Medtronic insulin pumps

     

A week after the U.S. Food and Drug Administration (FDA) warned about cybersecurity risks attached to some models of insulin pumps manufactured by American medical equipment supplier Medtronic, India’s apex drug regulator, the Central Drug Standard Control Organisation (CDSCO) has also issued an alert.

CDSCO noted that some models were vulnerable to hackers and an unauthorised person with technical skills and equipment could potentially connect wirelessly to a nearby insulin pump to change the settings and control insulin delivery. India has a growing population of diabetics. 

CDSCO has advised that patients and caregivers should check and see if the model and software version of their insulin pump is affected, talk to their healthcare provider about a prescription to switch to a model with better cyber security protection, keep the insulin pump and the devices that are connected to them within their control and not share their pump serial number and be attentive to pump notifications, alarms and alerts.

It further advises patients to disconnect the USB device from their computer when it is not being used to download data from their pump.

The affected models include Minimed Paradigm (MMT-715, MMT-712 & MMT-722) and MiniMed Paradigm Veo (MMT-754) Insulin Pump.

Company’s response

Responding to the alert, an official statement on behalf of Medtronic India said: “On June 25, 2019, Medtronic notified customers of potential cybersecurity risk in the MiniMed508 and MiniMed Paradigm series of insulin pumps; these models are from 2012 and earlier…” 

“At this time, we have not received any confirmed reports of unauthorised persons changing settings or controlling insulin delivery. Medtronic provided its customers and their doctors with recommended security precautions when using their insulin pump. This is a safety notification only.’’

It said that in India, Medtronic was pro-actively informing the regulators and other relevant stakeholders and was in the process of working with researchers, doctors and patients to address any questions or concerns that they may have.

“No patient issues have been reported in India so far. MiniMed 508 had been discontinued in India since 2011,” it added.