A heart pump controller drew a Class I recall with no attacker in sight

MedDevice Cyber Staff · Oct 14 · 3 min read · Via MedTech Dive

Joshua Taylor / Unsplash

Johnson & Johnson’s Abiomed told customers on October 5 about vulnerabilities in the operating system of the Automated Impella Controller, tied to network and physical access, that could end in loss of device control or an unexpected pump stop. FDA published the recall on October 14 and classified it Class I, the category reserved for potential serious injury or death. Five products are covered. No harm and no attacks have been reported.

The fix sequence says a lot about connected device reality. Field representatives are disabling network capabilities on deployed controllers, customers got instructions to do the same themselves, and the devices stay on the market while security updates are developed for an eventual reconnection.

The vulnerabilities came out of Abiomed’s own routine cybersecurity risk assessments, and it is the third Impella recall since June, after a run of purge pressure notices. Finding your own flaws and taking the recall is what the postmarket half of FDA’s framework looks like when it works, and it still costs a Class I headline.

Remediation Desk

Vulnerabilities in the Automated Impella Controller operating system could allow loss of device control or an unexpected pump stop, and FDA classified the action Class I on potential harm alone. Apply the corrective action and treat operating-system currency on life-sustaining controllers as a safety obligation, not an IT chore.

Apply the field correction. Follow the recall corrective action for the Automated Impella Controller.
Own the embedded OS lifecycle. Track and patch the operating system inside the controller; a Class I classification here was about potential harm, not a breach.
Design for safe failure. A controller for a life-sustaining pump should degrade to a safe state rather than stop unexpectedly under fault.

Questions & Answers

Why was the Impella controller recall Class I if nobody was harmed?

FDA classifies on potential outcome, and a loss of device control or unexpected stop on a circulatory support pump carries potential for serious injury or death. The classification does not require an actual attack or injury.

What is the vulnerability in the Automated Impella Controller?

Abiomed reported operating system vulnerabilities tied to network and physical access. Exploited, they could allow loss of device control or an unexpected pump stop. The company found them in its own routine security risk assessments.

What should hospitals do with affected Impella controllers?

Disable the network capabilities. Abiomed field representatives are doing this on deployed units, and customers received instructions to do it themselves. Devices remain usable, and security updates for reconnection are in development.

← Back to Vulnerabilities