WASHINGTON (WHTM) – Federal health officials are warning diabetes patients that certain insulin pumps have potential cybersecurity risks.
The Food and Drug Administration says someone other than a patient or health care provider could wirelessly connect to a nearby Medtronic MiniMed insulin pump that has the vulnerabilities and then change the pump’s settings to either over-deliver insulin to a patient or stop insulin delivery.
Medtronic cannot update the MiniMed 508 and Paradigm models to address the potential risks, so the FDA recommends patients replace the affected pumps with models that are better equipped to protect them.
The FDA is not aware of any reports of patient harm related to the potential risk.
Medtronic is recalling the following affected MiniMed pumps and providing alternative insulin pumps to patients.
|Pump Model||Software Version|
|MiniMed™ 508||All versions|
|MiniMed™ Paradigm™ 511||All versions|
|MiniMed™ Paradigm™ 512/712||All versions|
|MiniMed™ Paradigm™ 515/715||All versions|
|MiniMed™ Paradigm™ 522/722||All versions|
|MiniMed™ Paradigm™ 522K/722K||All versions|
|MiniMed™ Paradigm™ 523/723||Version 2.4A or lower|
|MiniMed™ Paradigm™ 523K/723K||Version 2.4A or lower|
|MiniMed™ Paradigm™ 712E*||All versions|
|MiniMed™ Paradigm™ Veo 554CM/754CM*||Version 2.7A or lower|
|MiniMed™ Paradigm™ Veo 554/754*||Version 2.6A or lower|
* Available outside the United States only.
The FDA says people should check to see if the model and software version of their insulin pump is affected. The Medtronic Patient LetterExternal Link Disclaimer explains how to identify your pump’s software version.
To minimize the potential risk of a cybersecurity attack while you are waiting for a replacement pump, the FDA says:
- Keep your insulin pump and the devices that are connected to your pump within your control at all times whenever possible.
- Do not share your pump serial number.
- Be attentive to pump notifications, alarms, and alerts.
- Monitor your blood glucose levels closely and act appropriately.
- Immediately cancel any unintended boluses.
- Connect your Medtronic insulin pump to other Medtronic devices and software only.
- Disconnect the USB device from your computer when you are not using it to download data from your pump.
Get medical help right away if you:
- Have symptoms of severe hypoglycemia (such as excessive sweating, feeling very tired, dizzy and weak, being pale, and a sudden feeling of hunger).
- Have symptoms of diabetic ketoacidosis (such as excessive thirst, frequent urination, nausea and vomiting, feeling very tired and weak, shortness of breath).
- Think your insulin pump settings or insulin delivery changed unexpectedly.