FDA warns patients about Bluetooth flaws affecting pacemakers, glucose monitors

It is the latest in a series of FDA advisories to inform patients of potential cybersecurity and safety risks.

Pacemakers and glucose-monitoring systems are among the critical medical equipment that could be affected by new security vulnerabilities in wireless technology, the Food and Drug Administration and Department of Homeland Security warned this week.

The set of flaws in a popular wireless protocol known as Bluetooth Low Energy (BLE), which impact microchipped devices in a range of industries, could allow a hacker within radio range of a device to disrupt its communications, forcing it to restart.

There have not been any reports of malicious exploitation or patient harm related to the vulnerabilities. The FDA advised medical device manufacturers to work with health care providers, patients, and facilities to figure out which devices are affected and “to ensure that risks are reduced to acceptable levels.”

How many medical device manufacturers, which use the vulnerable microchips, are implicated remains to be seen. It is up to the manufacturers themselves to verify the extent to which they are affected.

Erika Winkels, a spokesperson for Medtronic, a Minneapolis-based medical device maker, said some of the company’s pacemakers and parts of glucose-monitoring systems are affected by the vulnerability. However, she said the impact of the vulnerability is limited to temporary disruption of communication between the medical equipment and other devices and “does not impact therapy.”

“To date, no cyberattack, data breach, or patient harm involving a Medtronic product has been observed or associated with these vulnerabilities,” Winkels said. “We monitor our products and systems to assess any impact associated with cybersecurity issues and take appropriate actions as circumstances dictate.”

The dozen BLE vulnerabilities, discovered by researchers at the Singapore University of Technology and Design, affect at least seven big microchip manufacturers, including Texas Instruments. Most of those vendors have issued fixes for the bugs. The researchers pointed to multiple proof-of concept exploits for the vulnerabilities.

The FDA is urging manufacturers to assess their equipment and report any that is vulnerable to DHS’s Cybersecurity and Infrastructure Security Agency. CISA itself is still trying to notify affected manufacturers.

Stephanie Domas, executive vice president at health care cybersecurity company MedSec, said the vulnerabilities are a reminder of how complex the ecosystem of suppliers and customers of medical devices is.

“Medical device manufacturers need quick-acting methods for intaking vulnerability information, assessing the risk, and then getting information out to healthcare delivery organizations (HDOs),” Domas told CyberScoop. Those HDOs need their own processes in place for assessing risk and taking appropriate action, she added.

“There are a lot of moving pieces, a lot of stakeholders at the table, and it requires coordination across all of them,” Domas said.

It is only the latest in a series of advisories that the FDA has put out to inform patients of the potential cybersecurity and safety risks of connected devices and encourage manufacturers to update their firmware.

“Medical devices are becoming increasingly connected, and connected devices have inherent risks, which make them vulnerable to security breaches,” said Suzanne Schwartz, a senior cybersecurity official at the FDA.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure