High FDA (Devices)·Z-1525-2020·Announced 2020-03-25

Medtronic CareLink Encore Programmer Recalled for Cyber Vulnerabilities

Medtronic is recalling CareLink Encore 29901 programmers due to improper access control and cleartext transmission of sensitive information.

What this means for you

Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.

Our severity reasoning: The recall involves a medical device with cyber vulnerabilities that pose a risk of harm (data breach) but no specific injuries or illnesses have been reported, fitting the 'High' severity criteria for risk-of-harm products without reported injury.

Plain-English summary

Medtronic Inc. is recalling the CareLink Encore 29901 Programmer, a medical device used to interrogate and program implantable cardiac devices such as pacemakers, ICDs, and CRTs. The recall affects 5,540 units distributed worldwide, including the United States and numerous international locations.

The recall was initiated because the device was determined to contain two primary cyber vulnerabilities: improper access control and the cleartext transmission of sensitive information. These vulnerabilities pose a risk to the security of the data handled by the programmer.

Healthcare providers and consumers with this device should contact Medtronic for further instructions on how to address the vulnerabilities. The recall covers all serial numbers for Product Number 29901.

The recalled product

Product: Medtronic CareLink Encore 29901 Programmer. Used to interrogate and program Medtronic and Vitatron implantable devices, such as pacemaker/ICD/CRT.
Manufacturer: Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)
Category: Medical Device — Cardiac Programmer
Hazard: cyber-vulnerability
data-breach
Affected units: 5,540

Is your product affected?

Check your packaging against the codes below. If any of them match, the product is part of this recall.

Lot numbers (20)

Product Number 29901
All Serial Numbers
Known Model Numbers: a. Model Number 29901
GTIN (Lot Numbers): 00643169369030 (JVD000243P)
00643169369030 (JVD000246P)
00643169369030 (JVD000248P)
00643169369030 (JVD000249P)
00643169369030 (JVD000250P)
00643169369030 (JVD000252P)
00643169369030 (JVD000270P)
00643169369030 (JVD000274P)
00643169369030 (JVD000277P)
00643169369030 (JVD000280P)
00643169369030 (JVD000281P)
00643169369030 (JVD000302P)
00643169369030 (JVD000303P)
00643169167087 (JVD000304P)
00643169369030 (JVD000312P)
00643169369030 (JVD000315P)
00643169167087 (JVD000317P)

Distribution

Distributed nationwide across the United States.

The notice also names 5 states specifically:

Part of a larger recall action

This product is one of 2 recalled by Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF) under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.

See all 2 products in this recall →

Same manufacturer · Medtronic Inc., Cardiac Rhythm and Heart Failure (CRHF)

See all →

Critical
Medtronic CRT-D Defibrillators: Rare Energy Output Failure Risk During Therapy
FDA (Devices) · 2023-06-28
Severe
Medtronic Implantable Cardioverter Defibrillators Recalled for Reduced Therapy Output
FDA (Devices) · 2023-06-28
Severe
Medtronic Implantable Defibrillators Recalled for Potential Therapy Delivery Failure
FDA (Devices) · 2023-06-28
Severe
Implantable Cardioverter Defibrillators at Risk of Reduced Energy Output
FDA (Devices) · 2023-06-28
Severe
Medtronic Implantable Cardioverter Defibrillator may lose energy output during therapy
FDA (Devices) · 2023-06-28

Same hazard · cyber vulnerability