Cybersecurity Vulnerabilities in Connected Diabetes Devices

Stay Safe: Cybersecurity Risks in Connected Diabetes Devices

Many blood glucose meters now send each result to a phone app over Bluetooth Low Energy (BLE), the low-power version of Bluetooth used by wearables (we cover the basics in Connectivity and Data Standards (Bluetooth/BLE)). That wireless hop is convenient. It is also a new place where data can be read or changed.

The FDA names BLE directly in its premarket cybersecurity guidance. It asks manufacturers to decide whether they need extra security controls layered beneath BLE, in case flaws in the protocol itself are discovered later [1]. One harm the guidance singles out is data that has been spoofed or modified, such as a false reading passed from a continuous glucose monitor to an automated insulin pump [1].

Watch Out for Proprietary Protocols

A proprietary protocol is the private set of rules a manufacturer's meter and app use to talk to each other. Keeping those rules secret doesn't make them secure, because anyone who captures enough traffic can try to work them out. We looked for a primary source showing that a specific OneTouch or Roche meter protocol had been reverse-engineered, and we didn't find one that names the devices and dates the work, so we don't name brands here.

The attack itself is a real design concern. In a replay attack, someone records a valid message, such as a glucose result, and sends it again later so the app accepts stale or false data. The FDA tells manufacturers to assume an adversary can "alter, drop, and replay packets" and to build their threat model on that assumption [1]. It also warns that cyclic redundancy checks (CRCs), a common type of error-detecting code, catch electrical noise but offer no protection against a deliberate attacker [1]. What to do about a reading you suspect is wrong, including any insulin decision, is something to work out with your care team.

The FDA Steps In

The tougher rules have a start date. The Consolidated Appropriations Act, 2023, signed on December 29, 2022, added section 524B to the main federal law governing medical devices, known as the FD&C Act [3]. Since March 29, 2023, any premarket submission for a "cyber device" must include a plan to find and address vulnerabilities after the device is on the market, plus processes that keep the device secure and let the manufacturer ship updates and patches [3].

It must also include a Software Bill of Materials (SBOM): an inventory of the commercial, open-source and off-the-shelf software inside the device [3]. Under the law, a cyber device is one that runs software and can connect to the internet, with features that could be vulnerable to cybersecurity threats [3]. FDA's guidance adds that threat modeling should run throughout design and cover every part of the device system [1]. As of October 2026, the current edition of that guidance is dated February 3, 2026, replacing the June 27, 2025 version [1].

A Safer Future with Encryption

IEEE 2621 is sometimes described as an encryption standard. It is broader than that: a family of security-assurance standards for wireless diabetes devices [2]. The FDA recognized one part, IEEE/UL 2621.2-2022, on December 19, 2022 [4]. That part sets out the security requirements a connected diabetes device must meet, written as a "protection profile" under the ISO/IEC 15408 evaluation framework so an evaluator can test a product against it [4].

The FDA attaches a caveat to its recognition. Conforming to 2621.2 may not satisfy every requirement of section 524B or every recommendation in its guidance [4]. And section 524B doesn't reach backward: it doesn't apply to submissions made before March 29, 2023, so a connected device cleared earlier wasn't required to file an SBOM unless a later change sent it back for premarket review [3].