Abbott's St. Jude Patches Device Software After Regulators Confirm Weaknesses

By Maria Armental 

Abbott Laboratories' St. Jude Medical has released a security patch for some of its medical devices after U.S. health regulators found hackers might be able to gain access.

The Food and Drug Administration found that criminals could potentially remotely access a patient's implanted cardiac device and drain the battery or deliver inappropriate pacing or shocks.

The FDA said there haven't been any reports of patient harm related to the cybersecurity vulnerabilities.

Monday's security update requires additional validation and verification of remotely-monitored pacemakers and defibrillators, St. Jude said.

The Minnesota-based company is working with the FDA and the Department of Homeland Security Industrial Control Systems Cyber Emergency Response Team on additional updates to address other security issues. No details were given on those vulnerabilities.

St. Jude, which merged last week with Abbott, had previously denied the remote monitoring system used with implanted pacemakers and defibrillators could be hacked and sued research firm Muddy Waters Capital LLC and cybersecurity startup MedSec.

"This long-overdue acknowledgement...reaffirms our belief that had we not gone public, St. Jude would not have remediated the vulnerabilities, " Muddy Waters Capital founder Carson Block said in a prepared statement.

"Regardless, the announced fixes do not appear to address many of the larger problems, including the existence of a universal code that could allow hackers to control the implants," Mr. Carson wrote.

St. Jude couldn't immediately be reached for comment.

Abbott's stock, up 6% this year, closed down 4 cents Monday at $40.74.

Write to Maria Armental at [e-mail]

(END) Dow Jones Newswires

January 09, 2017 17:18 ET (22:18 GMT)

Copyright (c) 2017 Dow Jones & Company, Inc.