MiniMed™ 600 series pump system communication issue

Vulnerability summary

The MiniMed™ 600 series pump system consists of components such as the pump, continuous glucose monitoring (CGM) transmitter, blood glucose meter and CareLink™ USB device that communicate wirelessly. Medtronic has recently identified a potential issue through internal testing whereby, under specific circumstances, the communication between the components of the pump system could be compromised through unauthorized access.

For unauthorized access to occur, a nearby person other than the patient or their care partner would need to gain access to the pump at the same time that the pump is being paired with other system components. This cannot be done over the internet.

Medtronic has no evidence to date that such an issue has occurred. However, in the unlikely event that unauthorized access would be successful, the access could be used to deliver too much or too little insulin through delivery of an unintended insulin bolus or because insulin delivery is slowed or stopped. Too much insulin could result in hypoglycemia (low blood sugar) which can potentially lead to seizure, coma or death. Too little insulin could result in hyperglycemia (high blood sugar) which can potentially lead to diabetic ketoacidosis.

Medtronic recommends all patients take the actions and precautions listed below. 

Actions recommended for all patients:

1. Turn off the “Remote Bolus” feature on your pump if it is turned on. Note that the “Remote Bolus” capability is on by default, so you should take this action even if you have never used this feature.
   
   
   • See Appendix: How to turn off Remote Bolus settings?
   • Or by visiting our website at medtronicdiabetes.com/remote-bolus
2. Conduct any connection linking of devices in a non-public place.

Precautions recommended for all patients:

1. Keep your pump and connected system components within your control at all times.
2. Be attentive to pump notifications, alarms, and alerts. 
3. Immediately cancel any boluses you or your care partner did not initiate, monitor blood glucose levels closely and reach out to Medtronic 24-Hour Technical Support to report the bolus. NOTE: Turning off remote bolus feature will ensure no remote bolus is possible
4. Disconnect the USB device from your computer when you’re not using it to download pump data.
5. DO NOT confirm remote connection requests or any other remote action on the pump screen unless it is initiated by you or your care partner.

6. DO NOT share your pump’s or devices’ serial numbers with anyone other than your healthcare provider, distributors, and Medtronic.
7. DO NOT accept, calibrate, or bolus using a blood glucose reading you didn’t initiate.
8. DO NOT connect to or allow any third-party devices to be connected to your pump
9. DO NOT use any software which has not been authorized by Medtronic as being safe for use with your pump.
10. Get medical help immediately when experiencing symptoms of severe hypoglycemia or diabetic ketoacidosis.
11. Reach out to Medtronic 24-Hour Technical Support if you suspect a pump setting or insulin delivery have changed unexpectedly, without your knowledge.

Medtronic has additional general security information, at the following location:

https://www.medtronic.com/security

The best step you can take now to eliminate your individual risk of unintended delivery of insulin is to permanently turn off the Remote Bolus feature on your pump. We will continue to actively monitor the situation and are committed to sharing relevant information or actions with you in the future.

We understand this impacts your experience and are here to support you. If you have further questions, please call the Medtronic 24-Hour Technical Support line at 1-800-646-4633, option 1.