Country's apex drug regulator CDSCO on July 3 issued an alert about insulin pumps manufactured by US medical equipment giant Medtronic, saying they have cybersecurity risks as someone other than the patient can wirelessly connect to them, change its settings and control insulin delivery. 

The alert said this could allow a person to overdose the patient with insulin, leading to low blood sugar (hypoglycemia), or to stop insulin delivery, leading to high blood sugar and diabetic ketoacidosis (a buildup of acids in the blood). The CDSCO in its alert said,"Security researchers have identified potential cybersecurity vulnerabilities related to these insulin pumps. "Any unauthorised person with special technical skills and equipment could potentially connect wirelessly to a nearby insulin pump and change the pump's settings and control the delivery," the Central Drugs Standard Control Organisation (CDSCO) said in its alert.

Medtronic India issued a statement on July 3 and said its parent company - Medtronic plc - had notified customers on June 25 of potential cybersecurity risk in their pumps. The CDSCO's alert comes a week after the US Food and Drug Administration (US FDA) issued a warning to patients and health care providers that certain Medtronic MiniMed insulin pumps are being recalled due to potential cybersecurity risks.

The FDA also recommended that, patients with diabetes using these models, should switch their insulin pump to models that are better equipped to protect against these potential risks even. The FDA's warning had also added that it is not aware of any confirmed reports of patient harm related to these potential cybersecurity risks. Medtronic India said its parent company - Medtronic plc - had notified customers on June 25 of potential cybersecurity risk in the MiniMed 508 and MiniMed Paradigm series of insulin pumps. These models are from 2012 and earlier, it said. "At this time, we have not received any confirmed reports of unauthorized persons changing settings or controlling insulin delivery. Medtronic provided its customers and their doctors with recommended security precautions when using their insulin pump. 

"These include paying attention to any pump notifications, alarms and alerts apart from others. Kindly note that the insulin pumps are not being recalled and are not required to be returned. This is a safety notification only," the statement said. It said Medtronic is proactively informing the regulators and other relevant stakeholders in the process of working with researchers, doctors and patients to address any questions or concerns that they may have on the issue. No patient issues have been reported in India so far. MiniMed 508 had been discontinued in India since 2011. "Over the years, we have launched many advanced models of insulin pumps and they are safe for patients. At Medtronic, we take quality concerns with the utmost seriousness, and the safety of patients is our primary concern...," the statement said. 

The CDSCO has advised healthcare professionals, distributers and users and staff involved in the management of patients to check and see if the model and the software version of their insulin pump is affected. It has advised them to monitor blood glucose levels closely and immediately cancel any unintended boluses.

It also advised not to share the pump serial number, be attentive to pump notifications, alarms and alerts and connecting the Medtronic insulin pump in use to other Medtronic devices and software only. The CDSCO stated that it has not received any complaints from the market on the issue.