Medical device makers race to understand scope of SweynTooth vulnerabilities

Medical-technology companies are working quickly to assess the cybersecurity of their health care devices following public disclosure this week of a suite of serious security problems in common low-energy Bluetooth communication systems.

Millions of devices, including many medical devices, could be hacked and shut down because of flaws in low-power versions of the ubiquitous wireless communications technology, researchers at the Singapore University of Technology and Design disclosed in a paper last month.

The report documented at least 12 different vulnerabilities that it collectively dubbed SweynTooth (pronounced “swain-tooth”), specifically calling out medical devices from Medtronic and VivaChek Biotech as being vulnerable.

Other companies’ products may also be affected, but the work of assessing SweynTooth’s impacts across med-tech is ongoing. As of today, the Food and Drug Administration cannot issue a full list of affected devices, because no such list exists — it’s up to each manufacturer to assess impacts and decide if software patches are needed. The FDA announcement simply listed three common types of medical devices that could potentially be affected: pacemakers, glucose monitors and ultrasound devices.

Medtronic, run from offices in Minnesota, has confirmed some of its heart and diabetes devices are impacted, while GE Healthcare in Wisconsin said its ultrasound systems are not. Heart-device maker Boston Scientific has found no effects from SweynTooth. Abbott Laboratories is continuing to evaluate its products, but so far has detected no impacts for most of its devices, including the widely used FreeStyle Libre glucose monitor. China-based VivaChek Biotech is testing a software patch for affected blood-glucose meters that it plans to released by March 13.