Critical Cybersecurity Vulnerability Found in Certain Heart Pumps, Posing Serious Health Risks

The U.S. Food and Drug Administration (FDA) has issued a critical alert regarding cybersecurity vulnerabilities affecting Abiomed’s Automated Impella Controller (AIC), a device used to support the heart. This issue, identified by Abiomed, has been classified as the most serious type of recall by the FDA, meaning the device could cause severe injury or death if used without a necessary correction. The AIC plays a vital role in Impella therapy by controlling and monitoring the Impella Catheter, which assists the heart’s recovery by reducing its workload.

Abiomed is initiating a correction process for the affected devices, which include all Impella Controller, Impella Optical Controller, and Impella Connect units sold in the U.S. The company has notified customers of the identified vulnerabilities, which relate to network and physical access that could be compromised. If exploited, these vulnerabilities could lead to uncontrolled risks impacting the AIC’s operating system, potentially resulting in a loss of device control or an unexpected pump stop. Such an event could lead to a cessation of hemodynamic support, posing a life-threatening risk to patients, including permanent impairment or death. To date, there have been no reported cyberattacks or patient harm associated with these specific vulnerabilities.

Customers are advised to keep the AIC in a secure environment with restricted access, regardless of whether it is in clinical use. To mitigate the cybersecurity risks, Abiomed field representatives will contact affected customers to arrange for the AIC to be disabled from the network. The AIC can continue to be used as intended even after its network capabilities are removed. Healthcare facilities that wish to disable the AIC’s network functions before being contacted by an Abiomed representative should reach out to ra-abm-fieldaction@its.jnj.com or their local clinical field staff for detailed instructions.

It is imperative that all relevant personnel within healthcare facilities, including those responsible for managing, transporting, storing, stocking, or using the AIC, review the provided notice. If an AIC has been transferred to another facility, the originating facility must contact the receiving facility and share Abiomed’s notice. In the event of a suspected cybersecurity incident involving the AIC, healthcare professionals and consumers are urged to report it to Abiomed via their product security website at https://www.productsecurity.jnj.com. Abiomed is actively developing security updates and measures to address these vulnerabilities and will provide further information as mitigation strategies become available to re-enable network connectivity. The company maintains a continuous monitoring process for cybersecurity vulnerabilities and will issue updates as significant new information arises.

For customers in the U.S. experiencing adverse reactions, quality issues, or who have questions regarding this recall, Abiomed can be contacted directly at ra-abm-fieldaction@its.jnj.com or by phone at 978-646-1400. The FDA also encourages healthcare professionals and consumers to report any adverse reactions or quality problems encountered with these devices through its MedWatch program, the FDA Safety Information and Adverse Event Reporting Program. The Unique Device Identifier (UDI) system is in place to enhance the identification and reporting of medical devices, facilitating quicker identification and resolution of device-related problems.

Article by Mel Anara, based upon information from the U.S. Food and Drug Administration.

---