The Recall Desk
Agency classClass IIOur severity:HighFDA (Devices)·Z-1524-2020·Announced 2020-03-25

Medtronic CareLink 2090 Programmer Recalled for Cyber Vulnerabilities

Medtronic is recalling 23,180 CareLink 2090 Programmer devices worldwide due to improper access control and cleartext transmission of sensitive information.

The agency’s classification

FDA (Devices): Class II

Class II is a situation in which use of or exposure to a violative product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote.

This is the agency’s own classification, taken from its notice. The severity score below is our assessment, not the agency’s. How recall classes work

What this means for you

Our assessment, not the agency’s: severity 3/5 (High).

Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.

Our severity reasoning: The recall involves a medical device with cyber vulnerabilities that pose a risk of harm (data breach/unauthorized access) but the source text does not report any actual injuries, illnesses, or deaths, fitting the 'High' criteria for risk-of-harm products where injury has not yet been reported.

Plain-English summary

Medtronic Inc. is recalling 23,180 units of the CareLink 2090 Programmer, a device used to interrogate and program Medtronic and Vitatron implantable devices such as pacemakers, ICDs, and CRTs. The recall is due to the discovery of two primary cyber vulnerabilities in the associated Medtronic Conexus Telemetry system: improper access control and the cleartext transmission of sensitive information.

The affected devices have been distributed worldwide, including in the United States, Puerto Rico, and numerous countries across the Americas, Europe, Asia, Africa, and Oceania. The recall covers all serial numbers of Product Number 2090.

Consumers and healthcare providers should contact Medtronic for further instructions on how to address these vulnerabilities. The source text does not specify a particular consumer action beyond the recall notification.

The recalled product

Product
Medtronic CareLink 2090 Programmer. Used to interrogate and program Medtronic and Vitatron implantable devices, such as pacemaker/ICD/CRT.
Manufacturer
Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)
Category
Medical Device — Cardiac Rhythm Management
Hazard
Affected units
23,180

Is your product affected?

Check your packaging against the codes below. If any of them match, the product is part of this recall.

Lot numbers (20)

  • Product Number 2090
  • All Serial Numbers
  • Known Model Numbers: a. Model Number 2090
  • GTIN (Lot Numbers): 00721902546341 (PKK002840R)
  • 00721902246234 (PKK012608R)
  • 00721902246234 (PKK013358R)
  • 00721902569517 (PKK017436R)
  • 00613994580955 (PKK204009R)
  • 00643169537828 (PKK001072R)
  • 00613994175397 (PKK001076R)
  • 00613994175397 (PKK001135R)
  • 00613994175397 (PKK001172R)
  • 00613994175120 (PKK001321R)
  • 00613994175106 (PKK001322R)
  • 00721902246234 (PKK001324R)
  • 00721902246227 (PKK001327R)
  • 00613994175212 (PKK001328R)
  • 00613994175106 (PKK001331R)
  • 00643169537828 (PKK001332R)
  • 00721902246234 (PKK001335R)

Distribution

Distributed nationwide across the United States.

The notice also names 5 states specifically:

Part of a larger recall action

This product is one of 2 recalled by Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF) under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.

See all 2 products in this recall →

Related recalls

Same manufacturer · Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)

See all →

Same hazard · cyber vulnerability

See all →

Similar recalls