Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity
    Start here
    Services
    • Medical Device Cybersecurity Consulting
    • FDA Premarket Cybersecurity Package
    • Medical Device Penetration Testing Services
    • FDA Deficiency Response
    • FDA Postmarket Cybersecurity
    • Medical Device Threat Modeling
    • eSTAR Cybersecurity Documentation Support
    See all services
    Products

    Blue Goat products

    • GoatWatch logoGoatWatchSBOM risk management for medical devices
    About
    Resources

    Learn

    • Blog
    • Podcast
    • Webinars
    • Talks & workshops
    • Glossary
    • FAQs

    Playbooks & Tools

    • Guides
    • Playbooks (PDF)
    • Infographics
    • Interactive Tools

    Signals & Proof

    • Goat FeedNew
    • News
    • Medical Device Security News
    • The Goat's Weekly
    • Case Studies
    • Proof / Receipts
    All resources, topic hubs, & collections →
    ⌘K
    Book Strategy SessionHow to prepare →
    Blue Goat Cyber

    Full-service medical device cybersecurity. We protect patients by securing connected medical devices from design through postmarket.

    275+ FDA submissions supported, zero cybersecurity rejections · Mission: 1,000 by 2028

    SDVOSB · Service-Disabled Veteran-Owned Small Business

    We sponsor 10 community projects →

    Services

    • FDA Premarket Cybersecurity Package
    • FDA Deficiency Response
    • Medical Device Threat Modeling
    • Medical Device Penetration Testing Services
    • FDA Postmarket Cybersecurity
    • All services →
    Services
    • FDA Premarket Cybersecurity Package
    • FDA Deficiency Response
    • Medical Device Threat Modeling
    • Medical Device Penetration Testing Services
    • FDA Postmarket Cybersecurity
    • All services →

    Company

    • About
    • Core values
    • Manifesto
    • Leadership
    • Why Us
    • Partners
    • Careers
    • Press
    • Press kit
    • Contact
    • Company overviewPDF
    Company
    • About
    • Core values
    • Manifesto
    • Leadership
    • Why Us
    • Partners
    • Careers
    • Press
    • Press kit
    • Contact
    • Company overviewPDF

    Resources

    • Blog
    • Guides
    • Podcast
    • Case studies
    • Monthly Pulse newsletter
    • All resources →
    Resources
    • Blog
    • Guides
    • Podcast
    • Case studies
    • Monthly Pulse newsletter
    • All resources →

    Get in touch

    • info@bluegoatcyber.com
    • 844-939-GOAT
    • Book a strategy session →
    • 1776 N Scottsdale Rd, Unit 727
      Scottsdale, AZ 85257Serving clients worldwide

    Follow

    © 2026 Blue Goat Cyber. All rights reserved.

    • Privacy
    • Terms
    • Cookies
    • Sitemap
    • Accessibility
    • CVD

    MedTech Cybersecurity · Since 2022

    Goat Feed · Topic

    #cyber

    Items tagged #cyber

    Back to the daily feed
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Beckman Coulter, Inc - UNICEL DXI 800 ACCESS IMMUNO ANALY

    Reported to the FDA Oct 29, 2026 (event Feb 13, 2025). The FDA publishes these reports weeks after receipt. The customer reported a Sample Presentation Unit (SPU) motion error on a UniCel DxI 800 Access Immunoassay Analyzer, Product Number 973100, Serial Number (b)(6). As reported, patie

    Blue Goat take· Blue Goat Cyber Research

    This mechanical failure highlights how single-point availability risks in high-volume immunoassay platforms directly disrupt clinical workflows and delay critical diagnostics. Labs without redundant systems are most exposed to these downtime events. Security leads must ensure that maintenance logs and firmware updates for automated sample units are prioritized to prevent similar operational bottlenecks that the FDA monitors via adverse event reporting.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jun 23, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein when a user logs out of the application, the authenticated session token remains valid

    Blue Goat take· Blue Goat Cyber Research

    This session management defect creates a temporary window where an attacker can hijack a session despite a user logging out. Healthcare IT vendors and diagnostic imaging firms with web-based clinical portals are most exposed to this risk. Manufacturers should audit their logout procedures to ensure tokens are invalidated on the server immediately rather than relying solely on client-side timeouts.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein the system does not require a second step of verification (multi-factor authentication

    Blue Goat take· Blue Goat Cyber Research

    This report indicates a breakdown in identity management where single-factor authentication fails to prevent unauthorized data manipulation. Imaging centers and cardiology departments using networked workstations are most exposed to potential patient record tampering or data breaches. Security leads should verify that internal access controls are strictly enforced and prioritize testing for credential bypass vulnerabilities within their clinical information systems.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein the ISCV is shipped with unsigned binaries, installers, and scripts. The device was ou

    Blue Goat take· Blue Goat Cyber Research

    This failure to enforce code signing means attackers with local access can inject malicious updates or scripts that the system will trust as legitimate. Diagnostic imaging hubs and cardiovascular departments with large server footprints are most exposed to this integrity risk. Engineering teams must prioritize cryptographic validation for all future software builds and audit existing deployments for unauthorized binary modifications.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein in trusted domain mode, if two users from different trusted domains share the same use

    Blue Goat take· Blue Goat Cyber Research

    This defect allows account hijacking via username collisions across trusted domains, essentially breaking identity isolation in multi-tenant enterprise environments. Cardiovascular imaging platforms and hospital networks using federated identity management face the highest risk of unauthorized data modification. Founders should verify that their authentication modules handle unique identifiers beyond simple usernames to prevent similar privilege escalation flaws.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Unknown manufacturer - Dexcom G7 Mobile Application

    Reported to the FDA Oct 26, 2026 (event Oct 12, 2026). The FDA publishes these reports weeks after receipt. I am a type 1 diabetic and rely heavily on the Dexcom G7 Continuous Glucose Monitor\in my disease management. I have used the Dexcom G7 for about 2 weeks, but have\used other Dexco

    Blue Goat take· Blue Goat Cyber Research

    This report highlights how mandatory software updates or terms of service changes can trigger patient safety concerns regarding data privacy and unauthorized metadata collection. Makers of mobile medical applications and cloud-connected wearables are most exposed to these privacy-related adverse event filings. Teams should review their consent workflows and data harvesting practices to ensure they do not create operational barriers that patients perceive as safety risks.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Abbott Diabetes Care Ltd - Lingo App

    Reported to the FDA Oct 23, 2026 (event Sep 16, 2026). The FDA publishes these reports weeks after receipt. A third-party reported to Abbott Diabetes Care (ADC) of a cybersecurity vulnerability with the Lingo application. The cybersecurity vulnerability was identified to affect communica

    Blue Goat take· Blue Goat Cyber Research

    This report highlights a critical flaw in Bluetooth Low Energy pairing that allows attackers to spoof medical sensors and feed false clinical data to users. Mobile medical app developers and wearable manufacturers are most exposed, particularly those using persistent BLE connections for real-time monitoring. Tech leads should audit sensor authentication protocols and verify that reconnection handshakes cannot be bypassed by nearby malicious devices.

    OM
    SourceopenFDA MAUDE
    abbott
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Abbott Diabetes Care Ltd - Libre App

    Reported to the FDA Oct 23, 2026 (event Sep 16, 2026). The FDA publishes these reports weeks after receipt. A third-party reported to Abbott Diabetes Care (ADC) of a cybersecurity vulnerability with the Libre Application. The cybersecurity vulnerability was identified to affect communica

    Blue Goat take· Blue Goat Cyber Research

    This vulnerability involves a sensor spoofing risk where attackers bypass Bluetooth authentication to feed false glucose data to a patient app. Manufacturers of Class II wearable monitors using wireless protocols are most exposed, particularly those relying on standard BLE pairing for clinical telemetry. Security teams should audit reconnection handshakes and verify that incoming data streams cannot be manipulated by third-party devices in close proximity.

    OM
    SourceopenFDA MAUDE
    abbott
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Abbott Diabetes Care Ltd - FreeStyle Libre 3 Application

    Reported to the FDA Oct 23, 2026 (event Sep 16, 2026). The FDA publishes these reports weeks after receipt. A third-party reported to Abbott Diabetes Care (ADC) of a cybersecurity vulnerability with the FreeStyle Libre 3 application. The cybersecurity vulnerability was identified to affe

    Blue Goat take· Blue Goat Cyber Research

    This MAUDE report highlights a failure in the Bluetooth Low Energy authentication process that allows unauthorized devices to spoof sensor data. Manufacturers of mobile health apps and wearable sensors with automated treatment triggers are most exposed to this type of impersonation risk. Security teams should audit reconnection handshakes for similar logic flaws and monitor for updated vendor mitigation strategies.

    OM
    SourceopenFDA MAUDE
    abbott
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDENov 10, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: Medtronic Puerto Rico Operations Co. - Pump MMT-1886 780G OUS BLE Pump mg/dL

    Reported to the FDA Oct 22, 2026 (event Oct 1, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: CAREFUSION 303, INC. - BD Pyxis¿ Anesthesia Station ES

    Reported to the FDA Oct 16, 2026 (event Sep 17, 2026). The FDA publishes these reports weeks after receipt. A review of the complaint history for SN (b)(6)was performed in Salesforce which did not locate similar complaint(s) with the same failure mode for this serial number.\\A review of

    Blue Goat take· Blue Goat Cyber Research

    This ransomware incident reveals how lateral network movement can force automated dispensing cabinets into critical override, bypassing software controls for medication security. Manufacturers of network-connected point-of-care systems are most exposed, particularly those with large install bases in high-acuity surgical environments. Leaders should audit remote administrative access protocols and verify that database management tools are hardened against unauthorized execution during active outages.

    OM
    SourceopenFDA MAUDE
    bd
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 16, 2026 (event Jun 23, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in IntelliSpace Cardiovascular (ISCV) whereby the thick client application does not adequately distinguish between legitimate and ma

    Blue Goat take· Blue Goat Cyber Research

    This DLL hijacking defect means attackers can trick the application into running malicious code by placing files in specific folders. Imaging centers and hospitals using thick client cardiovascular workstations are most at risk because local access could lead to data corruption or system downtime. Teams should verify folder permissions on active installations and monitor for incoming Philips service bulletins regarding software hardening.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 16, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in IntelliSpace Cardiovascular (ISCV) wherein the application uses an outdated version of ASP.NET in the Service Tool, which may exp

    Blue Goat take· Blue Goat Cyber Research

    This defect highlights how legacy dependencies in service tools create backdoors that bypass clinical safety controls. Manufacturers of enterprise imaging and informatics platforms are most exposed, as these tools often remain active across large hospital networks. Teams should audit internal service utilities for end of life frameworks and prioritize updates to prevent unauthorized configuration changes.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 16, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in IntelliSpace Cardiovascular (ISCV) whereby ISCV users could browse image repository folders and navigate to patient folders conta

    Blue Goat take· Blue Goat Cyber Research

    This software defect allows authorized users to bypass application security controls to view or edit patient DICOM files directly on the file system. Large hospital systems using centralized cardiovascular imaging platforms are most exposed to this internal privacy risk. Manufacturers must ensure thick client architectures do not grant excessive file system permissions that circumvent application level audit logs and access rules.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: CAREFUSION 303, INC. - BD Pyxis¿ MedStation¿ ES

    Reported to the FDA Oct 16, 2026 (event May 15, 2026). The FDA publishes these reports weeks after receipt. D4 & H4: Serial number, Catalog, Model, Unique Device Identifier and Manufacturer Date not available.\\A device evaluation is anticipated but has not yet begun. Upon completion of

    Blue Goat take· Blue Goat Cyber Research

    This UI malfunction indicates a failure in state synchronization between the operating system and the medical application after security updates. Manufacturers of interconnected pharmacy automation systems are most exposed to these logic errors when deploying tiered patches. Engineers should audit reboot triggers and update status flags to ensure visual alerts accurately reflect the current system state during maintenance.

    OM
    SourceopenFDA MAUDE
    bd
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDENov 10, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: BOSTON SCIENTIFIC CORPORATION - EMBLEM? MRI S-ICD

    Reported to the FDA Oct 12, 2026 (event Sep 15, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: EDAN Instruments, Inc. - Patient Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: EDAN Instruments, Inc. - Fetal & Maternal Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    Blue Goat take· Blue Goat Cyber Research

    This vulnerability confirms that lateral movement within a hospital network can bypass device authentication via simple broadcast domain proximity. Manufacturers of legacy bedside monitors and network-connected diagnostics are most exposed, particularly where VLAN segmentation is weak. Security leads should verify internal network isolation and review how local discovery protocols handle privilege escalation.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: EDAN Instruments, Inc. - Vital Signs Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    Blue Goat take· Blue Goat Cyber Research

    This vulnerability signals a failure in network layer isolation, allowing attackers with local network access to hijack monitor functions. Manufacturers of patient bedside tech with legacy broadcast protocols are most at risk, particularly in high volume clinical settings. Security leads should audit VLAN configurations and ensure internal network segmentation restricts unauthorized lateral movement to medical VLANs.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: EDAN Instruments, Inc. - Fetal & Maternal Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    Blue Goat take· Blue Goat Cyber Research

    This vulnerability indicates weak network segmentation and poor local authentication controls on bedside monitors. Manufacturers of legacy telemetry and patient monitoring systems are most exposed, as these devices often lack the encryption needed for flat hospital networks. Security leads should validate that maternal care units are isolated on protected VLANs and audit all peer to peer communication protocols for unauthorized access.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: EDAN Instruments, Inc. - Vital Signs Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    Blue Goat take· Blue Goat Cyber Research

    This flaw highlights a failure in network segmentation where an attacker on the same local network can bypass standard access controls to gain unauthorized privileges. Manufacturers of legacy bedside monitors and mobile clinical workstations are most exposed to this lateral movement risk. Security teams should prioritize isolating these devices into dedicated VLANs and verify that local authentication cannot be circumvented via broadcast traffic.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: EDAN Instruments, Inc. - Fetal Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    Blue Goat take· Blue Goat Cyber Research

    This report signals a failure in network segmentation where an attacker on the local subnet can escalate privileges to compromise patient monitoring data. Manufacturers of legacy bedside monitors with unencrypted broadcast protocols are most exposed, particularly in high-acuity clinical settings. Engineering leads should verify that VLAN configurations isolate these devices and monitor for unauthorized lateral movement originating from the hospital LAN.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDENov 10, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: Medtronic Puerto Rico Operations Co. - MiniMed 780G OUS System BLE Connect 3.0 mmol/L

    Reported to the FDA Oct 6, 2026 (event Sep 18, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    infoMAUDENov 10, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: MEDTRONIC MINIMED - CARELINK PERSONAL MMT-7333

    Reported to the FDA Oct 2, 2026 (event Sep 21, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Acclaro Corporation - UltraClear

    Reported to the FDA Sep 30, 2026 (event Aug 12, 2026). The FDA publishes these reports weeks after receipt. On (b)(6) 2026 the patient received UltraClear treatment. According to the patient impact form completed by the clinic, the treating physician immediately noticed that there was a

    Blue Goat take· Blue Goat Cyber Research

    This hardware failure indicates that physical degradation of optical components can cause laser systems to deliver energy outside intended parameters, leading to patient injury. Manufacturers of Class II energy-based surgical devices are most exposed, especially those using adhesives for critical lens alignment. Engineering teams should review vibration testing protocols and verify if current preventative maintenance schedules adequately detect loose internal optics before they fail.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: MEDTRONIC PUERTO RICO OPERATIONS CO. - INTELLIS

    Reported to the FDA Sep 25, 2026. The FDA publishes these reports weeks after receipt. Information was received from a patient (pt) regarding an implantable neurostimulator (INS). The reason for call was Pt stated that they had a couple MRIs done of their lower back

    Blue Goat take· Blue Goat Cyber Research

    This report signals that perceived security breaches can manifest as physical pain or device malfunctions in patients with neurostimulators. Manufacturers of active implants are most exposed to these complaints, which often follow public vulnerability disclosures or official patient letters. You should monitor how cybersecurity notices impact patient psychology and ensure support teams can distinguish between technical exploits and psychosomatic symptoms.

    OM
    SourceopenFDA MAUDE
    medtronic
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDENov 10, 2026 · 13:00 UTC

    MAUDE adverse event: Abbott Diabetes Care Inc - FreeStyle Libre 3 Plus

    Reported to the FDA Sep 11, 2026 (event Aug 15, 2026). The FDA publishes these reports weeks after receipt. Sensor (b)(6)has been returned and investigated. Visual inspection performed on the returned sensor patch and no issue was observed. Data was extracted using approved software and

    Blue Goat take· Blue Goat Cyber Research

    This log event indicates a sensor termination triggered by specific internal error codes, with one code explicitly flagging a potential cybersecurity event. Manufacturers of Class II wearables and connected diagnostic sensors are most exposed, as these reports highlight how software logic now distinguishes security events from mechanical failures. Teams should monitor for SECURE-1 updates and ensure log extraction processes can isolate security triggers during root cause analysis.

    OM
    SourceopenFDA MAUDE
    abbott
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDEOct 21, 2026 · 13:00 UTC

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Sep 7, 2026 (event Mar 24, 2026). The FDA publishes these reports weeks after receipt. Philips reviewed the reported complaint requesting ISCV design such that there is no direct connection required to database from thick client.Based on the results of the investigat

    Blue Goat take· Blue Goat Cyber Research

    This report signals a critical architectural flaw where thick client software bypasses security controls by connecting directly to the database. Manufacturers of enterprise imaging systems and diagnostic workstations are most exposed to this risk of unauthorized bulk data manipulation. The FDA will likely scrutinize similar direct-access configurations, so teams should audit their client-server trust models immediately.

    OM
    SourceopenFDA MAUDE
    philips
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDEOct 13, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: MEDTRONIC MINIMED - CARELINK PERSONAL MMT-7333

    Reported to the FDA Sep 8, 2026 (event Apr 7, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDEOct 13, 2026 · 13:00 UTC

    MAUDE adverse event: CAREFUSION 303, INC. - BD Pyxis¿ ES Server

    Reported to the FDA Sep 29, 2026 (event Sep 2, 2026). The FDA publishes these reports weeks after receipt. D.4 & H.4: Serial Number, Unique Device Identifier, and Manufacturer Date not available.Upon investigation of the actual device used in this incident, it was determined that the fa

    Blue Goat take· Blue Goat Cyber Research

    This ransomware incident confirms that external network breaches can trigger fail-safe modes, like Critical Override, that disrupt medication dispensing workflows. Manufacturers of centralized pharmacy automation and hospital-wide server systems are most exposed to these availability risks. Security leads must validate that local override procedures are functional and that technical support playbooks for rapid server resynchronization are tested before a breach occurs.

    OM
    SourceopenFDA MAUDE
    bd
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDEOct 13, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Sep 25, 2026 (event Jan 20, 2025). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDEOct 13, 2026 · 13:00 UTC

    MAUDE adverse event: Beckman Coulter, Inc - ACCESS 2 IMMUNOASSAY ANALYZER

    Reported to the FDA Sep 22, 2026 (event Dec 6, 2024). The FDA publishes these reports weeks after receipt. The customer reported receiving unexpectedly high Access hsTnI (Part Number B52699) patient results on an Access 2 Analyzer (serial number (b)(6)). No adverse patient impact, injur

    Blue Goat take· Blue Goat Cyber Research

    This report highlights how third-party reagent software can trigger unauthorized configuration changes in core system settings, potentially leading to critical diagnostic errors. Manufacturers of modular IVD systems with open reagent architectures face the highest risk of cross-assay interference. Leaders must audit third-party software integration points to ensure local assay configurations remain isolated from global system unit settings.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDEOct 13, 2026 · 13:00 UTC

    Unconfirmed hacking claim in FDA report: Medtronic Puerto Rico Operations Co. - MiniMed 780G US System BLE Connect 3.0 mg/dL

    Reported to the FDA Sep 8, 2026 (event Aug 26, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDEOct 5, 2026 · 14:11 UTC

    MAUDE adverse event: MicroPort CRM S.r.l. - HookUp

    Analysis synthesis:Review of the software analysis confirmed the reported behavior during the LBBOT procedure, with spontaneous QRS complexes incorrectly detected as pacing spikes, leading to inappropriate measurements.The investigation showed that a specific QRS morphology on le

    Blue Goat take· Blue Goat Cyber Research

    This software logic failure signifies that signal processing algorithms can misinterpret physiological data as device artifacts, causing clinical misdiagnosis without a hardware defect. Manufacturers of diagnostic cardiac software and pacing programmers are most exposed, especially those using automated spike detection. Teams should audit signal filtering thresholds for specific patient morphologies and monitor for similar algorithmic edge cases in field performance data.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDEOct 5, 2026 · 14:11 UTC

    Unconfirmed hacking claim in FDA report: Medtronic Puerto Rico Operations Co. - MiniMed 780G US System BLE Connect 3.0 mg/dL

    Reported to the FDA Aug 19, 2026. The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.

    notableMAUDEOct 5, 2026 · 14:11 UTC

    MAUDE adverse event: MEDTRONIC PUERTO RICO OPERATIONS CO. - InterStim X

    Information was received from a patient who was implanted with an implantable neurostimulator (INS) for urinary/bowel dysfunction. It was reported that since they started having bronchitis in (b)(6) of this year, their therapy wouldn't let them go past 1.3 mA. The patient attempt

    Blue Goat take· Blue Goat Cyber Research

    This failure to connect to an active implantable neurostimulator highlights how identity theft and external data breaches can degrade patient trust in device safety during clinical complications. Manufacturers of Class III active implants are most exposed, as patients may wrongly attribute hardware connectivity issues to a publicized corporate cybersecurity incident. Product teams must monitor for increased support volume and ensure that incident response messaging clearly distinguishes between IT data breaches and device functional integrity.

    OM
    SourceopenFDA MAUDE
    medtronic
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDEOct 5, 2026 · 14:11 UTC

    MAUDE adverse event: ARC-ONE SOLUTIONS, LLC - Regulated Software Application (RSA), Version 2.0

    NA. ARC-One Solutions received information regarding Regulated Software Application (RSA), Version 2.0 (BK200512). Specifically, an issue related to importing blood products into RSA 2.0 from a blood center's own facility, and the ability to ship these products to customers for

    Blue Goat take· Blue Goat Cyber Research

    This malfunction highlights how manual data entry during post-cyberattack recovery creates high risks for data integrity and clinical errors. Blood centers and transfusion software providers are most exposed to these reconciliation gaps when transitioning from downtime procedures back to automated systems. Manufacturers should audit their import validation rules to prevent incorrect product creation during emergency restoration phases.

    OM
    SourceopenFDA MAUDE
    #maude#adverse-event#cyber
    Read full alert
    notableMAUDEOct 5, 2026 · 14:11 UTC

    MAUDE adverse event: Medtronic, Inc. - Medtronic IPG

    It was reported by the patient that they received a letter from Medtronic indicating that there was a personal data breach. The Impl antable Pulse Generator (IPG) remains in use. No patient complications have been reported as a result of this event. Correction: B5 Medtronic subm

    Blue Goat take· Blue Goat Cyber Research

    This MAUDE entry signals that data privacy incidents now trigger mandatory medical device reporting if the breach involves information linked to active implants. Manufacturers of Class III life sustaining devices are most exposed here, as even non-clinical IT breaches now require regulatory filings under 21 CFR 803. The FDA will likely increase scrutiny on how backend data security impacts overall device system integrity.

    OM
    SourceopenFDA MAUDE
    medtronic
    #maude#adverse-event#cyber
    Read full alert
    infoMAUDEOct 5, 2026 · 14:11 UTC

    Unconfirmed hacking claim in FDA report: Varian Medical Systems Imaging Laboratory GmbH - ARIA Radiation Therapy Management

    Reported to the FDA Aug 24, 2026. The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.