Cybersecurity in Connected CGM Ecosystems

Cybersecurity in Connected CGM Ecosystems

A continuous glucose monitor (CGM) rarely works alone. The sensor sends readings over Bluetooth Low Energy (BLE), a low-power radio standard, to a phone, receiver or pump, and the data often travels on to the cloud [1]. Every one of those links is a place where someone could read or change data that wasn't meant for them. The record of real problems is short, though. As of October 2026, the only alerts on the FDA's cybersecurity list that name a diabetes device are two warnings about older MiniMed insulin pumps, and none is about a CGM sensor itself [2].

What a CGM ecosystem is made of

When we read the engineering literature, "ecosystem" turned out to be a literal description. One review describes BLE carrying meter results to smartphone apps, linking glucose devices to each other, and feeding a pump the data it needs for closed-loop operation, with cloud platforms storing the results [1]. Closed loop means automated insulin delivery (AID): software in the pump adjusts insulin based on CGM readings.

The FDA treats that radio link as seriously as a network cable. Its February 2026 cybersecurity guidance lists Bluetooth and Bluetooth Low Energy among the features that give a device "the ability to connect to the internet" [3]. That ability is one of three tests for a "cyber device" under section 524B of the Federal Food, Drug, and Cosmetic Act. The other two are software in the device and technology that is open to cybersecurity threats [3].

What an attacker could do with glucose data

Passive attacks only listen. Here's what surprised us: a BLE device announces itself to anything scanning nearby, so a glucose device that broadcast a readable name such as "Glucometer_xyz" could reveal that someone nearby has diabetes [1]. In a man-in-the-middle attack, an eavesdropper captures key information during pairing (the first handshake between two devices) and later decrypts their traffic [1]. Our article on CGM data privacy and cybersecurity follows the data once it reaches the cloud.

Active attacks change things, and they are the safety problem. Writing in 2011, Paul, Kohno and Klonoff noted that insulin doses are adjusted from CGM readings. That makes two CGM threats serious: altering glucose values in transit, and inventing new readings and transmitting them [4]. The pump side was reachable too. In laboratory tests, their team sent commands to an insulin pump from an unauthorized remote programmer 100 feet away [4]. On its own, one intercepted glucose value is worth little to an attacker; a substituted value that feeds an insulin decision is a different matter [1].

Two real cases: MiniMed pumps in 2019 and 2022

Both of the FDA's diabetes cybersecurity alerts involve pumps that talk to CGMs. On June 27, 2019, the FDA warned of potential cybersecurity risks in certain MiniMed Paradigm insulin pumps and recommended that patients replace them with better-protected models [2]. The recall records explain why. The pumps use a wireless radio-frequency link, and an unauthorized person nearby could connect to one to change its settings and control insulin delivery [5]. Affected models such as the Paradigm 522, 722, 523, 723 and Veo are listed as pumps used with a glucose sensor, and Medtronic sent customers an updated notice on January 4, 2023 [5].

The second alert, on September 20, 2022, covered the MiniMed 600 series, such as the 630G and 670G [2]. The FDA described a weakness in the communication protocol shared by the pump, the CGM transmitter, the blood glucose meter and the CareLink USB device. An unauthorized person would have to be nearby while the pump was being paired with other components, and the FDA said it was not aware of any reports related to the vulnerability [2]. Medtronic's correction notice told users to turn off the pump's Remote Bolus feature, which shipped switched on, and to link devices only in a non-public place [6].

Both pump families are legacy products. The FDA's 2019 advice was to move off the affected Paradigm models [2], and the company, now called MiniMed, launched its smallest pump yet, the app-controlled MiniMed Flex, in the US in June 2026 [7]. Questions about a specific older pump belong with the manufacturer and your care team.

What the FDA asks of connected CGMs

Security has been part of the CGM rules since 2018. When the FDA authorized the Dexcom G6 as the first integrated CGM (iCGM), a CGM built to send data to devices such as AID systems, it named "patient harm due to insecure transmission of iCGM data" as a risk to control [8]. Every iCGM's design verification must now include "a detailed strategy to ensure secure and reliable means of iCGM data transmission" [8]. The G6 review describes a threat model covering the transmitter, the receiver and the phone apps, plus a plan for keeping the device secure after launch [8]. Dexcom has since begun phasing out the G6 to focus on newer sensors such as the Dexcom G7 15 Day [9].

Section 524B took effect on March 29, 2023 [2]. For a new cyber device submission, the manufacturer must include a plan to monitor, identify and address vulnerabilities after launch, including coordinated vulnerability disclosure, a process for outside researchers to report flaws [3]. Manufacturers must also release updates and patches on a regular cycle, sooner for critical flaws, and provide a software bill of materials (SBOM) listing the commercial, open-source and off-the-shelf software inside [3]. As of October 2026, the FDA's guidance on these duties is the final version issued February 3, 2026 [3]. Abbott, which makes the FreeStyle Libre sensors, publicly runs a coordinated disclosure program for security researchers [10].

Where the weak points usually sit

Bluetooth can be secure, but only if the device maker builds it that way. BLE's authentication (proving a device is what it claims to be) and encryption (scrambling data so only key holders can read it) are optional parts of the specification, and a user can't switch them on later [1]. Even an encrypted link leaves a gap. It secures the radio connection between two devices, not the connection to a particular app, and in some cases another app on the same phone can use that link. The review's fix is authentication at the app level [1].

Mixing brands adds a key-sharing problem. Paul and colleagues saw standard encryption such as the Advanced Encryption Standard (AES) as a workable base, but a system built from several companies' devices needs those companies to share keys without burdening patients [4]. That is now the normal case, since one company's CGM often drives another company's pump (see our article on interoperability with automated insulin delivery). They also flagged a trade-off that hasn't gone away: strong encryption could block emergency staff who need a pump's data [4].

Fixing these weak points isn't always a quick software push. The FDA's guidance lists changes to authentication or encryption algorithms, and new connectivity features, among changes that may need a new premarket submission [3]. A security upgrade to a connected CGM or pump can mean another trip through the regulator.