FDA issues Class I alert for Abiomed Impella heart device over cybersecurity risks

Editor's Note

The Food and Drug Administration (FDA) on October 10 classified a cybersecurity correction involving Abiomed’s Automated Impella Controller as a Class I recall, the most serious type, according to the FDA Medical Device Recalls and Early Alerts database. While devices are not being removed from clinical settings, the agency warns that continued network use without correction could lead to serious injury or death.

The Impella Controller is a critical component that manages and monitors Abiomed’s Impella heart pump catheters, which help provide circulatory support for patients with weakened hearts. The FDA reports that Abiomed discovered cybersecurity vulnerabilities in the device’s operating system that pose unacceptable residual risk related to both network and physical access. If exploited, the flaws could disrupt the controller’s essential performance, potentially causing loss of device control or unexpected pump stoppage—events that could lead to life-threatening loss of hemodynamic support.

All US models and serial numbers of the Automated Impella Controller are affected, including several versions of the Impella Optical Controller and the AIC with Impella Connect. Abiomed has not received any reports of cyberattacks or patient harm, according to the alert. The company notified affected customers on October 1, advising facilities to keep all Automated Impella Controllers in secure, restricted areas and to disconnect them from hospital networks until cybersecurity updates can be implemented. Devices can continue to be used as intended once disconnected.

The company’s letter outlined required actions: facilities should disable the controller’s network capabilities with the assistance of an Abiomed field representative or by contacting the company directly via email or local field staff. Abiomed also instructed customers to share the notice with any departments or facilities where the devices are used or stored and to report any suspected cybersecurity events through its product security portal.