MiniMed^™ 508 insulin pump and MiniMed^™ Paradigm^™ series insulin pumps

January 2023

On June 27, 2019, Medtronic Inc. issued a “Urgent Field Safety Notification” letter for MiniMed™ 508 insulin pump and MiniMed™ Paradigm™ series insulin pump due to a potential cyber security issue. Medtronic has made the decision to renotify customers using insulin pumps that were affected by the recall. Since the issuance of our initial customer communication, the FDA has classified this correction as a Class II recall under the following recall numbers: Z-1581-2020, Z-1582-2020, Z-1583-2020, Z-1584-2020, Z-1585-2020, Z-1586-2020, Z-1587-2020, Z-1588-2020, Z-1589-2020, Z-1590-2020, Z-1591-2020, Z-1592-2020, Z-1593-2020, Z-1594-2020, Z-1595-2020, Z-1596-2020.

You may read the FDA’s Safety Communication about this potential cybersecurity risk at www.fda.gov/medical-devices/medical-device-safety/safety-communications under “2019 Safety Communications (Archived)”.

This letter provides the information and precautions to ensure that these actions are communicated to all customers using these products. We request that you please respond to this notification using the enclosed customer confirmation form, even if you previously responded to the June 2019 communication.

Cybersecurity Issue Description:
The MiniMed™ 508 insulin pump and the MiniMed™ Paradigm™ series insulin pumps (see Product Information below for model numbers) are designed to communicate using a wireless radio frequency (RF) with other devices such as blood glucose meters, glucose sensor transmitters, and CareLink™ USB devices.

Security researchers identified potential cybersecurity vulnerabilities related to these insulin pumps. An unauthorized person with special technical skills and equipment could potentially connect wirelessly to a nearby insulin pump to change settings and control insulin delivery. This could lead to hypoglycemia (if additional insulin is delivered) or hyperglycemia and diabetic ketoacidosis (if not enough insulin is delivered).

IMPORTANT NOTE:
At this time, we have received no confirmed reports of unauthorized persons changing settings or controlling insulin delivery.

The following pump models are vulnerable to this potential issue:

• To open the STATUS screen, press ESC until the STATUS screen appears.
• To view more text on the STATUS screen, press the up or down arrow to scroll and view all the information.
• To exit the STATUS screen, press ESC until the STATUS screen disappears.

ACTIONS REQUIRED:

1. Review and take the following cybersecurity precautions listed below.
2. Please complete and sign the customer confirmation form attached as indicated and return by mail using the attached prepaid envelope. You can also email this form to our Field Corrective Action Department at rs.safetyinformation@medtronic.com or send via fax to 1-888-844-8084 to the attention of FCA Department.

CYBERSECURITY PRECAUTIONS RECOMMENDED FOR ALL PATIENTS:

1. Keep your pump and connected system components within your control at all times.
2. Be attentive to pump notifications, alarms, and alerts. 
3. Immediately cancel any boluses you or your care partner did not initiate, monitor blood glucose levels closely and reach out to Medtronic 24-Hour Technical Support to report the bolus.
4. Disconnect the USB device from your computer when you’re not using it to download pump data. 
5. DO NOT share your pump’s or devices’ serial numbers with anyone other than your care partner, healthcare provider, distributors, and Medtronic.
6. DO NOT accept, calibrate, or bolus using a blood glucose reading you didn’t initiate.  
7. DO NOT connect to or allow any third-party devices not included with your pump system to be connected to your pump.
8. DO NOT use any software which has not been authorized by Medtronic as being safe for use with your pump. 
9. Get medical help immediately when experiencing symptoms of severe hypoglycemia or diabetic ketoacidosis. 
10. Reach out to Medtronic 24-Hour Technical Support if you suspect a pump setting or insulin delivery have changed unexpectedly, without your knowledge. 

If you continue using your MiniMed™ 508 or MiniMed™ Paradigm™ insulin pump, please take the cybersecurity precautions included above to help minimize risk while you continue to experience of the benefits of insulin pump therapy.

Please also note that, even if you have returned your remote control that was the subject of a separate recall that was initially communicated in August 2018 and expanded in October 2021, you should still take the cybersecurity precautions listed in this letter.

DISCONTINUATION OF MINIMED™ 508 AND MINIMED™ PARADIGM™ SERIES INSULIN PUMPS
MiniMed™ 508 insulin pump and the MiniMed™ Paradigm™ pumps are being discontinued as of April 2023. If you decide in consultation with your healthcare provider to update to a newer insulin pump model, please call Medtronic at 1-800-646-4633 option 3 or go to https://info.medtronicdiabetes.com/paradigm.

As always, we are here to support you. If you have further questions or need assistance, please call our 24-Hour Technical Support at: 1-800-646-4633, option 1.

Adverse reactions or quality problems experienced with this product may also be reported to FDA’s MedWatch Adverse Event Reporting program:

• Submit online: www.fda.gov/medwatch/report.htm
• Submit by regular mail or fax: Download form www.fda.gov/MedWatch/getforms.htm or call 1-800-332-1088 to request a form, then complete and return to the address on the pre-addressed form or submit by fax to 1-800-FDA-0178.

We apologize for any inconvenience this may cause. Your safety and satisfaction are our top priorities. We appreciate your time and attention in reading this important notification. Please acknowledge that you have read and understood this notification and have followed the actions and precautions listed in this letter by completing and returning the attached confirmation form by mail.

Sincerely,

Julio Salwen
Vice President, Quality
Medtronic Diabetes