Diabetic patients warned of fatal hacking risk in insulin pumps
Diabetic patients in the US have been warned hackers could access a wireless insulin pump made by Johnson & Johnson and deliver an overdose.
The cybersecurity flaw affects the healthcare company's Animas OneTouch Ping unit.
The unit, which was launched in 2008, has a wireless remote control that patients can use to order the pump to deliver insulin.
Cybersecurity firm Rapid7 Inc found communications between the remote control and the pump were not encrypted or scrambled.
This means a hacker could spoof communications between the two components from a distance of up to 25ft.
The flaw was discovered by security researcher Jay Radcliffe, who is a diabetic, and was published in a blog on Tuesday.
Johnson & Johnson described the risk as "extremely low", and there are no examples of security being breached, but executives said they wanted to alert customers and offer advice on how to fix the problem.
Medical experts said dosing a patient with too much insulin could cause hypoglycemia, or low blood sugar, which in extreme cases can be life-threatening.
A letter from Johnson & Johnson to doctors and more than 100,000 patients in the US and Canada said: "We have been notified of a cybersecurity issue, specifically that a person could potentially gain unauthorised access to the pump through its unencrypted radio frequency communication system.
"We want to assure you the probability of unauthorised access to the OneTouch Ping system is extremely low.
"It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network.
"In addition, the system has multiple safeguards to protect its integrity and prevent unauthorised action."
Johnson & Johnson said if patients are concerned, they could take several steps to thwart potential attacks.
They include discontinuing use of a wireless remote control and programming the pump to limit the maximum insulin dose.
The US Food and Drug Administration has said it knows of no cases where hackers have exploited cyber vulnerabilities to harm a patient.
It is understood that the device is not widely used in the UK.
Diabetic patients warned of fatal hacking risk in insulin pumps
