Open, Classified

Medtronic CareLink 2090 Programmer. Used to interrogate and program Medtronic and Vitatron implantable devices, such as pacemaker/ICD/CRT.

FDA Recall Z-1524-2020 · Posted None

Recalling FirmMedtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)

Recall StatusOpen, Classified

Product CodeOSR

Date Initiated2020-01-30

Product Quantity23,180 devices

Reason for Recall

Medtronic Conexus Telemetry has been determined to contain two primary cyber vulnerabilities: improper access control and the cleartext transmission of sensitive information.

Firm Action

Medtronic initially notified customers on about 03/21/2019 via a "Security Bulletin" regarding vulnerabilities to the proprietary Medtronic Conexus radio frequency wireless telemetry protocols associated with some Medtronic ICDs (implantable cardioverter defibrillators) and CRT-Ds (cardiac resynchronization therapy defibrillators). On about 01/30/2020, Medtronic notified customers with affected programmers of the field corrective action notification via 2-day UPS delivery of the consignee letter. On 21 March 2019, Medtronic posted a Security Bulletin regarding the vulnerabilities. Customers were instructed that Medtronic Representatives can assist in installing the Conexus Telemetry update on programmers Once the programmer has been updated, the updated software version can be identified on the programmer by selecting the programmer icon on the programmer screen. Then, select software from the dropdown menu. During device interrogation with an updated programmer at implant or the next regularly scheduled clinic visit, a patients device will automatically receive the updated software. Additionally the recall notice should be shared with all those who need to be aware within your organization or with any organization where programmers have been transferred. Questions regarding this information should be directed to the local Medtronic Representative or Medtronic Technical Services at 800-638-1991.

Root Cause

Software design

Distribution Pattern

Worldwide distribution. US Nationwide including Puerto Rico, Argentina, Brazil, Colombia, Trinidad and Tobago, Venezuela, Dominican Republic, Bahamas, Peru, Bermuda, Barbados, Ecuador, Cayman Islands, Curacao, Guatemala, Honduras, Panama, El Salvador, Costa Rica, Bolivia, Chile, Uruguay, Paraguay, Mexico, Jamaica, Japan, Belgium, Greece, Germany, Switzerland, United Kingdom, Spain, Italy, Luxembourg, Poland, Austria, Suriname, Netherlands, Aruba, Hungary, Liechtenstein, Sweden, Czech Republic, Ireland, France, French Polynesia, New Caledonia, Guadeloupe, Reunion, Mauritius, Kenya, South Africa, Uganda, Namibia, Finland, Norway, Portugal, Iceland, Denmark, Faroe Islands, Greenland, Macedonia, Iraq, Pakistan, Sudan, Jordan, Morocco, Belarus, Lebanon, Sri Lanka, Kazakhstan, Bulgaria, Egypt, Turkey, Libya, Serbia, Tunisia, Cyprus, Oman, Slovenia, Algeria, Malta, Croatia, Saudi Arabia, Syria, Kuwait, Latvia, Ukraine, Andorra, Burkina Faso, Nepal, Mayotte, French Guiana, Martinique, Bosnia And Herzegovina, Qatar, United Arab Emirates, Georgia, Yemen, Slovakia, Iran, Canada, Lithuania, United States, Cote D'Ivoire, Nicaragua, Zimbabwe, Azerbaijan, Albania, Ghana, India, Israel, Guam, American Samoa, Korea, Armenia, Mozambique, Nigeria, Bangladesh, Australia, Taiwan, Cambodia, Hong Kong, Malaysia, Viet Nam, Singapore, New Zealand, Indonesia, Philippines, Angola, Rwanda, Northern Mariana Islands, Senegal, Cameroon, Botswana,Russian Federation, Montenegro, China, Turkmenistan, St. Maarten, Tanzania, Kyrgyzstan, Netherlands Antilles, Cuba, Romania, Mongolia, Kosovo, Tajikistan, Benin, Ethiopia, Moldova, Afghanistan, Democratic Republic of Congo, and Thailand

Official Source

View FDA Recall →

Source: FDA Enforcement Report / Recall database. Always confirm against the official FDA record.