A heart pump controller drew a Class I recall with no attacker in sight

MedDevice Cyber Staff · Oct 14 · 3 min read · Via MedTech Dive

Johnson & Johnson’s Abiomed told customers on October 5 about vulnerabilities in the operating system of the Automated Impella Controller, tied to network and physical access, that could end in loss of device control or an unexpected pump stop. FDA published the recall on October 14 and classified it Class I, the category reserved for potential serious injury or death. Five products are covered. No harm and no attacks have been reported.

The flaws sit in the controller's operating system rather than in the pump mechanism, the inherited platform risk of building a medical device on general-purpose software. A weakness in that lower layer can expose functions the designers never meant to face outward, and ordinary operating-system bugs become loss of control on the machine above them.

The clinical reading is stark. An Impella controller drives a pump supporting a failing heart, so a fault that could surrender control or stop it without warning threatens a patient who cannot tolerate it. That is why the action landed in the most serious recall category on potential harm alone.

The fix sequence says a lot about connected device reality. Field representatives are disabling network capabilities on deployed controllers, customers got instructions to do the same themselves, and the devices stay on the market while security updates are developed for an eventual reconnection.

The vulnerabilities came out of Abiomed’s own routine cybersecurity risk assessments, and it is the third Impella recall since June, after a run of purge pressure notices. Finding your own flaws and taking the recall is what the postmarket half of FDA’s framework looks like when it works, and it still costs a Class I headline.

A device that sustains circulation cannot be pulled from service and returned later, so the mitigation must hold risk down while the machine keeps running, the balance that defines security work on life-sustaining equipment. The deeper issue is the operating system underneath, a component with a patch cadence of its own that sets the terms on which the device above stays safe.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Vulnerabilities in the Automated Impella Controller operating system could allow loss of device control or an unexpected pump stop, and FDA classified the action Class I on potential harm alone. Apply the corrective action and treat operating-system currency on life-sustaining controllers as a safety obligation, not an IT chore.

Apply the field correction. Follow the recall corrective action for the Automated Impella Controller.
Own the embedded OS lifecycle. Track and patch the operating system inside the controller; a Class I classification here was about potential harm, not a breach.
Design for safe failure. A controller for a life-sustaining pump should degrade to a safe state rather than stop unexpectedly under fault.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

ctl_therapy

Contributing

sys_named_os net_remote_access net_wireless net_wired sys_ots_software sys_firmware_update ctl_closed_loop use_hospital_net

EMB3D

PID-26 PID-41

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Why was the Impella controller recall Class I if nobody was harmed?

FDA classifies on potential outcome, and a loss of device control or unexpected stop on a circulatory support pump carries potential for serious injury or death. The classification does not require an actual attack or injury.

What is the vulnerability in the Automated Impella Controller?

Abiomed reported operating system vulnerabilities tied to network and physical access. Exploited, they could allow loss of device control or an unexpected pump stop. The company found them in its own routine security risk assessments.

What should hospitals do with affected Impella controllers?

Disable the network capabilities. Abiomed field representatives are doing this on deployed units, and customers received instructions to do it themselves. Devices remain usable, and security updates for reconnection are in development.

← Back to Vulnerabilities