The Recall Desk
Agency classClass IIOur severity:HighFDA (Devices)·Z-1525-2020·Announced 2020-03-25

Medtronic CareLink Encore Programmer Recalled for Cyber Vulnerabilities

Medtronic is recalling CareLink Encore 29901 programmers due to improper access control and cleartext transmission of sensitive information.

The agency’s classification

FDA (Devices): Class II

Class II is a situation in which use of or exposure to a violative product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote.

This is the agency’s own classification, taken from its notice. The severity score below is our assessment, not the agency’s. How recall classes work

What this means for you

Our assessment, not the agency’s: severity 3/5 (High).

Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.

Our severity reasoning: The recall involves a medical device with cyber vulnerabilities that pose a risk of harm (data breach) but no specific injuries or illnesses have been reported, fitting the 'High' severity criteria for risk-of-harm products without reported injury.

Plain-English summary

Medtronic Inc. is recalling the CareLink Encore 29901 Programmer, a medical device used to interrogate and program implantable cardiac devices such as pacemakers, ICDs, and CRTs. The recall affects 5,540 units distributed worldwide, including the United States and numerous international locations.

The recall was initiated because the device was determined to contain two primary cyber vulnerabilities: improper access control and the cleartext transmission of sensitive information. These vulnerabilities pose a risk to the security of the data handled by the programmer.

Healthcare providers and consumers with this device should contact Medtronic for further instructions on how to address the vulnerabilities. The recall covers all serial numbers for Product Number 29901.

The recalled product

Product
Medtronic CareLink Encore 29901 Programmer. Used to interrogate and program Medtronic and Vitatron implantable devices, such as pacemaker/ICD/CRT.
Manufacturer
Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)
Category
Medical Device — Cardiac Programmer
Hazard
Affected units
5,540

Is your product affected?

Check your packaging against the codes below. If any of them match, the product is part of this recall.

Lot numbers (20)

  • Product Number 29901
  • All Serial Numbers
  • Known Model Numbers: a. Model Number 29901
  • GTIN (Lot Numbers): 00643169369030 (JVD000243P)
  • 00643169369030 (JVD000246P)
  • 00643169369030 (JVD000248P)
  • 00643169369030 (JVD000249P)
  • 00643169369030 (JVD000250P)
  • 00643169369030 (JVD000252P)
  • 00643169369030 (JVD000270P)
  • 00643169369030 (JVD000274P)
  • 00643169369030 (JVD000277P)
  • 00643169369030 (JVD000280P)
  • 00643169369030 (JVD000281P)
  • 00643169369030 (JVD000302P)
  • 00643169369030 (JVD000303P)
  • 00643169167087 (JVD000304P)
  • 00643169369030 (JVD000312P)
  • 00643169369030 (JVD000315P)
  • 00643169167087 (JVD000317P)

Distribution

Distributed nationwide across the United States.

The notice also names 5 states specifically:

Part of a larger recall action

This product is one of 2 recalled by Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF) under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.

See all 2 products in this recall →

Related recalls

Same manufacturer · Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)

See all →

Same hazard · cyber vulnerability

See all →

Similar recalls