St. Jude Medical Class Action Alleges Pacemakers Unsecure

A class action alleges that cardiac devices such as pacemakers built by St. Jude Medical Inc., which include a “remote monitoring” feature use a transmitter and network that are completely unsecure from hacking.

The complaint asserts that all pacemakers, implantable cardioverter-defibrillators (“ICDs”) and cardiac resynchronization therapy defibrillators / pacemakers (“CRTs”) made by St. Jude Medical lack security measures that threaten the basic performance of these medically necessary devices.

The class action lawsuit states that in 2008, St. Jude Medical started advertising its “remote monitoring” ICDs and pacemakers.

Using a network, or “telemetry” system, patients using these new devices could transmit their implant data to their doctors at home.

This means patients would not have to go to the doctor for routine check-ups and data tests, which used to involve office visits every three months.

As the class action notes, these frequent office visits were “time consuming, expensive and inconvenient” for patients, and St. Jude advertised that consumers with remote monitoring devices had a “2.4 times greater probability of survival.”

However, the class action cites a third-party study which found that “St. Jude’s cardiac devices with RF telemetry capabilities, the Merlin@home transmitter and the Merlin.net PCN lacked even the most basic security defenses (such as strong authentication, encrypted software and code, anti-debugging tools, anti-tampering mechanisms and the use of a wand to activate RF wireless communications) that are used by other cardiac device manufacturers.”

St. Jude’s telemetry network does not even have the safety feature of requiring a password to protect a patient’s data, according to the complaint.

The study also showed how hackers could “obtain root access” in at least three ways, which would allow these bad actors to access data and exercise some control over these devices.

Plaintiff Clinton W. Ross, Jr. states that he had a St. Jude Quadra Assura CRT defibrillator implanted in November of 2015.

Ross claims that he was told the Quadra Assura would be remotely monitored by St. Jude’s “Merlin@home” transmitter, and that it was safe and secure.

However, Ross says that his physician has recommended that he stop using the Merlin@home transmitter because of its unsecure network.

Ross states that he does not intend to use the transmitter again until the safety issues are resolved by St. Jude Medical, and now has to go in for routine office visits for monitoring.

The St. Jude Medical unsecure pacemaker class action lawsuit alleges that St. Jude expressly told doctors and patients that its remote monitoring devices were safe.

The complaint argues that St. Jude Medical has breached an express warranty to consumers, that the company fraudulently concealed the flaw in its device network, and was negligent towards its customers.

The lawsuit seeks certification of a Class of all person implanted with a “pacemaker, implantable cardioverter-defibrillator, and cardiac resynchronization therapy pacemaker and/or defibrillator with radiofrequency (‘RF’) telemetry capability that was designed, manufactured, marketed, distributed or sold by the Defendants.”

The class action asks for restitution and damages for all Class Members.

Ross is represented by Mike Arias, Alfredo Torrijos, Elise R. Sanguinetti, and Jamie G. Goldstein of Arias Sanguinetti Stahle & Torrijos LLP.

The St. Jude Medical Unsecure Pacemaker Class Action Lawsuit is Clinton W. Ross Jr. v. St. Jude Medical Inc., et al., Case No. 2:16-cv-06465, in the U.S. District Court for the Central District of California.

UPDATE: The St. Jude Medical Unsecure Pacemaker class action lawsuit was dismissed on December 28, 2016.