Cybersecurity Vulnerabilities in Connected Medical Devices

Introduction to Cybersecurity Vulnerabilities in Connected Medical Devices

Once a Continuous Glucose Monitor (CGM) feeds an Automated Insulin Delivery (AID) system, a security flaw is no longer only a privacy problem. The pump acts on the data it receives, so bad data can become a safety problem. The FDA makes the same point in general terms in its premarket cybersecurity guidance: events across health care "have stressed the importance of cybersecurity to patient safety" [1].

Most of these devices talk over Bluetooth Low Energy (BLE), the low-power radio built into phones. When BLE security is weak, a nearby device can listen in (eavesdropping), and an eavesdropper that captures key information during pairing may be able to decrypt the traffic and sit between the two devices, a Man-in-the-Middle (MitM) attack [2]. A Replay attack resends a captured, valid message. FDA asks manufacturers to assume an attacker can "alter, drop, and replay" network traffic, and recommends anti-replay protection for potentially harmful commands [1]. Here's what surprised us: BLE authentication and encryption are optional parts of the Bluetooth specification. The manufacturer has to build them in, and a user can't switch them on [2].

Analysis of Key Vulnerabilities

The vulnerabilities fall into three groups:

• Integrity Attacks: Integrity means the reading or command that arrives is the one that was sent. A single glucose value is worth little to an attacker, but if that value feeds insulin dosing and someone can substitute false data, the result could harm the user [2]. On the pump side, researchers reported in 2011 that they had sent commands to an insulin pump from 100 feet away with an unauthorized remote programmer [3]. In June 2019 the FDA warned that older Medtronic MiniMed 508 and Paradigm pumps could be reached wirelessly by an unauthorized person who could change their settings, with a risk of insulin overdose or stopped delivery. Medtronic couldn't patch those pumps and offered replacements, which Klonoff and Han called the first recall of a connected diabetes device for cybersecurity reasons. The FDA said it wasn't aware of any patient harmed by that flaw [4].
• Denial of Service (DoS): A DoS attack keeps a device from doing its job. A 2011 review of insulin pump security listed "denying communication with the pump device" among the risks it identified. It also described attacks that drain a pump's battery on purpose through its wireless interface, and noted that turning the radio on only for short windows protects against them [3].
• Mobile Risks: Many CGMs use a smartphone app as the display. Bluetooth pairing and encryption protect the link between the phone and the device, but not the link between a particular app and the device, so a malicious app on the same phone may be able to use the connection. The BLE review says app-level authentication, which would close that gap, was still being developed as an optional BLE feature [2]. Reverse-engineering apps to extract API keys or proprietary protocols is another risk raised in security discussions, though we didn't find a primary source documenting it for a specific diabetes app.

Mitigation Strategies

FDA's cybersecurity expectations come from two places, and the difference matters. The binding part is law: section 524B of the Federal Food, Drug, and Cosmetic (FD&C) Act, added by the Food and Drug Omnibus Reform Act of 2022 and in effect since March 29, 2023, requires makers of "cyber devices" to provide a Software Bill of Materials (SBOM), a list of the commercial, open-source and off-the-shelf software inside the device [1]. A cyber device, in the law's terms, includes sponsor-authorized software, can connect to the internet, and has features that could be vulnerable to cybersecurity threats [1].

The guidance explains how FDA expects those rules to be met, and as of October 2026 the current edition is the one issued February 3, 2026, which replaced the June 27, 2025 version [1]. Its cryptography advice is labeled as nonbinding recommendations. It says to choose industry-standard algorithms expected to stay strong for the device's whole service life, use protocols that can negotiate parameters and versions so the most recent secure configuration is used, and avoid rollbacks to older, weaker versions [1]. The guidance never uses the phrase "cryptographic agility," but that negotiation advice is the closest it comes.

What FDA records show about specific CGMs is more modest than the earlier version of this article claimed. Abbott's FreeStyle Libre app and readers use near-field communication (NFC), the short-range tap technology, to start a new sensor, then receive glucose data over BLE [5]. The Dexcom G7 15 Day system requires the user to pair the display device with each new sensor before a session starts [6]. Both companies gave FDA cybersecurity risk-management documentation covering the confidentiality, integrity and availability of the system's data and software [5][6]. Neither decision summary says NFC or application-layer encryption is how the radio link is secured, so we don't claim it. The BLE review does list out-of-band techniques, including NFC, as good pairing practice for developers [2].

Conclusion

Across these sources, the weak points are the radio link and the apps around it, and the strongest fixes have to come from the manufacturer, because BLE's security features are something the device maker builds in [2]. The 2019 MiniMed recall showed what happens when an older device can't be patched: the remedy was a replacement pump [4]. Which pump and CGM combination suits you, and whether an older device should be replaced, is a decision to make with your care team. For the data side of the same problem, see our article on CGM Data Privacy and Cybersecurity.